系统日志配置（平台）
系统日志概述
系统日志 （syslog） 是系统中发生的所有事情的运行列表。您可以使用这些日志来审核事件或查看异常。您可以将系统日志配置为将特定类型系统（设施）的消息发送到外部系统日志服务器。（还可以 将事件日志导出到 CSV 文件。
系统日志配置包括以下详细信息：
| 名称 | 说明 |
|---|---|
| IP 地址 |
远程系统日志服务器 IP 地址或主机名 |
| 港口 |
远程系统日志服务器端口 |
| 协议 |
UDP 或 TCP |
| 设施 |
记录消息的系统类型 设施映射到 Apstra 系统日志，如下所示：
|
| 时区 | 系统日志消息时区。如果您有正确的时区转换，则无需将系统时区（或 Docker 时区）与外部系统日志服务器同步。时区转换需要将正确的时区信息附加到时间戳中，而不是假设消息时间采用 Zulu/UTC-0。然后，您可以在外部消息系统中更好地关联 Apstra 事件。 |
系统日志消息遵循通用事件格式 （CEF） 约定，如下所示：
注意：
{host} 是 Apstra 服务器主机名。如果要更改主机名，则必须使用 更改 Apstra 服务器主机名 页面上的过程。如果使用任何其他方法更改主机名，则新主机名将不会包含在系统日志条目中。
AOS Log Format:
'{timestamp} {host}'
'CEF:{version}|{device_vendor}|{device_product}|{device_version}|'
'{device_event_class_id}|{name}|{severity}|{extension}
Where:
{version} : CEF version, currently always "0"
{device_vendor} : always "Apstra"
{device_product} : always "AOS"
{device_version} : current AOS version
{device_event_class_id} : "100" for audit logs, "101" for anomaly logs
{name} : "Audit event" for audit logs, "Alert" for anomaly logs
{severity} : "5" for audit logs, "10" for anomaly logs
And where {extension} is either :
For anomaly logs : msg=<json payload>
For audit logs : cat=<activity> src=<src_IP> suser=<username> act=<activity result> cs1Label=<field1_type> cs1=<field1_value> cs2Label=<field2_type> cs2=<field2_value> cs3Label=<field3_type> cs3=<field3_value>
Anomaly Log JSON Format
blueprint_label : Name of the blueprint the anomaly was raised in.
timestamp : Unix timestamp when the Anomaly was raised.
origin_name : Serial Number of the device the anomaly affects.
alert : The value is a JSON Payload with the actual anomaly (see Alert JSON Payload below)
origin_hostname : Hostname of the device the anomaly affects. It can be AOSHOST, an empty string if the hostname could not be determined or a valid value.
device_hostname : Hostname of the device the anomaly affects or <device hostname unknown> if a hostname could not be determined
origin_role : Role of the device the anomaly affects.
Alert JSON Payload:
<ALERT TYPE>_alert: Contains a JSON payload with key-value pair of information pertaining to the alert. Here <ALERT TYPE>_alert can be valid anomaly/alert names such as hostname_alert, probe_alert, liveness_alert etc.
id : UUID of the anomaly.
first_seen : Unix timestamp when the Anomaly was raised for the first time.
raised : True when anomaly is present, False when it is cleared.
severity : The severity level of the anomaly. Set to 3 for critical, 2 for high, 1 for medium and 0 for low.
Audit Log Format:
cat : Activity performed. Valid values: "Login", "Logout","BlueprintCommit","BlueprintRevert","BlueprintRollback", "BlueprintDelete","DeviceConfigChange",
"OperationModeChangeToMaintenance","OperationModeChangeToNormal","OperationModeChangeToReadOnly","RatelimitExceptionAdd","RatelimitExceptionDelete",
"RatelimitClear","SystemChangeApiOperationModeToMaintenance","SystemChangeApiOperationModeToNormal","UserCrete","UserUpdate","UserDelete",
"SyslogCreate","SyslogUpdate","SyslogDelete","AuthAclEnable","AuthAclDisable","AuthAclRuleAdd","AuthAclRuleUpdate" and "AuthAclRuleDelete".
src : Source IP of the client making HTTP requests to perform the activity.
suser : Who performed the activity.
act : Outcome of the activity - free-form string. In the case when the activity was performed successfully, the value stored is “Success“. In case of error, include error string. Ex: Unauthorized
cs1Label : The string “Blueprint Name”. Only exists if activity is associated with a blueprint (optional)
cs1 : Name of the blueprint on which action was taken. Only exists if activity is associated with a blueprint (optional)
cs2Label : The string “Blueprint ID”. Only exists if activity is associated with a blueprint (optional)
cs2 : Id of the blueprint on which action was taken. Only exists if activity is associated with a blueprint (optional)
cs3Label : The string “Commit Message”. Only exists if user has added a commit message (optional)
cs3 : Commit Message. Only exists if user has added a commit message (optional)
deviceExternalId : Id (typically serial number) of the managed device on which action was taken. Only exists if activity is associated with a device such as for “DeviceConfigChange” (optional)
deviceConfig : Config that is pushed and applied on the device where “#012” is used to indicate a line break to log collectors and parsers. Only exists if activity is associated with a device such as for “DeviceConfigChange” (optional)
审计系统日志消息的示例：
Jan 31 03:11:01 aos-server - 2023-01-31T03:11:01.699190+0000 aos-server CEF:0|Apstra|AOS|4.1.2-269|100|Audit event|5|cat=Logout src=172.24.212.62 suser=admin act=Success Jan 31 03:11:01 aos-server - 2023-01-31T03:11:01.699190+0000 aos-server CEF:0|Apstra|AOS|4.1.2-269|100|Audit event|5|cat=BlueprintCommit src=172.24.212.62 suser=admin act=Success cs1Label=Blueprint Name cs1=rack-based-blueprint-33ded50f cs2Label=Blueprint ID cs2=rack-based-blueprint-33ded50f
异常系统日志消息的示例：
Jan 31 03:11:01 aos-server - 2023-01-31T03:11:01.699190+0000 aos-server
CEF:0|Apstra|AOS|4.1.2-269|101|Alert|10|msg={u'blueprint_label': u'rack-based-blueprint-33ded50f', u'timestamp': 1679002758562407, u'origin_name':
u'time_series', u'alert': {u'probe_alert': {u'expected_int_max': 99, u'stage_name': u'leaf_match_perc_range', u'probe_label': u'leaf_to_spine_interface_statuses',
u'actual_int': 83, u'probe_id': u'60b03bb0-0e22-4a6d-b32d-e15085149b7b', u'key_value_pairs': [], u'item_id': u'1', u'expected_int': -9223372036854775808},
u'first_seen': 1679002758562121, u'raised': False, u'severity': 3, u'id': u'02a17b60-cc3e-4afb-baba-733a8c654df6'}, u'origin_hostname': u'AOSHOST',
'device_hostname': '<device hostname unknown>', u'origin_role': u''}
Jan 31 03:11:01 aos-server - 2023-01-31T03:11:01.699190+0000 aos-server
CEF:0|Apstra|AOS|4.1.2-269|101|Alert|10|msg={u'blueprint_label': u'rack-based-blueprint-33ded50f', u'timestamp': 1679002754682990, u'origin_name':
u'50540015FA9D', u'alert': {u'first_seen': 1679002749600167, u'raised': False, u'severity': 3, u'hostname_alert': {u'expected_hostname': u'leaf-3',
u'actual_hostname': u''}, u'id': u'0457a759-7d3a-4bf8-97e8-e13e518cf267'}, u'origin_hostname': u'', 'device_hostname': '<device hostname unknown>', u'origin_role': u'leaf'}
从左侧导航菜单中，导航到 平台>外部服务>系统日志配置 以查看配置。您可以创建、克隆、编辑和删除系统日志配置。 
创建系统日志配置
- 从左侧导航菜单中，导航到平台>外部服务>系统日志配置，然后单击创建系统日志配置（右上角）。
- 配置系统日志服务器。（有关详细信息，请参阅上面的概述。
- 单击创建以保存配置并返回到表视图。
- 要配置其他系统日志服务器，请重复上述步骤。
- 若要允许将消息发送到已配置的服务器，请根据需要打开“用于审核”和/或“转发异常”。
编辑系统日志配置
- 从左侧导航菜单中，导航到平台>外部服务>系统日志配置，然后单击编辑按钮进行系统日志配置编辑。
- 进行更改。
- 单击更新以更新系统日志配置并返回到表视图。
删除系统日志配置
- 从左侧导航菜单中，导航到平台>外部服务>系统日志配置，然后单击删除按钮以删除系统日志配置。
- 单击删除系统日志配置以删除系统日志配置并返回到表视图。