Huawei S Series Switch
The Huawei S Series Switch DSM for JSA can accept events from Huawei S Series Switch appliances by using syslog.
JSA records all relevant IPv4 events that are forwarded from Huawei S Series Switches. To integrate your device with JSA, you must configure a log source, then configure your S Series Switch to forward syslog events.
The DSM supports events from the following Huawei S Series Switches:
Syslog Log Source Parameters for Huawei S Series Switch
If JSA does not automatically detect the log source, add a Huawei S Series Switch log source on the JSA Console by using the syslog protocol.
When using the syslog protocol, there are specific parameters that you must use.
The following table describes the parameters that require specific values to collect syslog events from Huawei S Series Switch:
Table 1: Syslog Log Source Parameters for the Huawei S Series Switch DSM
Log Source Name
Type a name for your log source.
Log Source Description
Type a description for the log source.
Log Source type
Huawei S Series Switch
Log Source Identifier
Type the IP address, host name, or name for the log source as an identifier for your Huawei S Series Switch.
Each log source that you create for your Huawei S Series Switch must include a unique identifier, such as an IP address or host name.
Configuring Your Huawei S Series Switch
To forward syslog events to JSA, you must configure your Huawei S Series Switch as an information center, then configure a log host.
The log host you create for your Huawei S Series Switch can forward events to your JSA console or an Event Collector.
- Log in to your Huawei S Series Switch command-line Interface (CLI).
- Type the following command to access the system view:
- Type the following command to enable the information center:
- Type the following command to send informational level
log messages to the default channel:
info-center source default channel loghost log level informational debug state off trap state off
- Optional: To verify your Huawei S Series Switch source
configuration, type the command:
display channel loghost
- Type the following command to configure the IP address
for JSA as the log host for your switch:
info-center loghost <IP address> facility <local>
<IP address> is the IP address of the JSA console or Event Collector.
<local> is the syslog facility, for example, local0.
info-center loghost 10.10.10.1 facility local0
- Type the following command to exit the configuration:
The configuration is complete. You can verify events that are forwarded to JSA by viewing events on the Log Activity tab.
Sample Event Message
Use this sample event message to verify a successful integration with JSA.
Huawei S Series Switch sample message when you use the Syslog protocol.
Due to formatting, paste the message format into a text editor and then remove any carriage return or line feed characters.
The following event shows that the source MAC address in the ARP packet is invalid.
May 22 2012 09:43:39huawei.sseriesswitch.test%%01SECE/3/ ARPS_DROP_PACKET_SRC_MAC(l): Invalidsourcemacaddress. (SourceMAC=0000-0000-0000,SourceIP=10.10.10.11,SourceInterface= XGigabitEthernet5/0/0,DropTime=2012/05/22 09:43:39)
Table 2: Highlighted Fields
JSA Field Name
Highlighted Payload Field Name
The Event ID is extracted from the payload header.
The Source IP can be the SourceAddress, SourceIP, or Source fields, which are available in the payload.
May 22 2012 09:43:39
The device time is extracted from the payload header.