Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

 
ON THIS PAGE
 

Huawei S Series Switch

The Huawei S Series Switch DSM for JSA can accept events from Huawei S Series Switch appliances by using syslog.

JSA records all relevant IPv4 events that are forwarded from Huawei S Series Switches. To integrate your device with JSA, you must configure a log source, then configure your S Series Switch to forward syslog events.

Supported Switches

The DSM supports events from the following Huawei S Series Switches:

  • S5700

  • S7700

  • S9700

Syslog Log Source Parameters for Huawei S Series Switch

If JSA does not automatically detect the log source, add a Huawei S Series Switch log source on the JSA Console by using the syslog protocol.

When using the syslog protocol, there are specific parameters that you must use.

The following table describes the parameters that require specific values to collect syslog events from Huawei S Series Switch:

Table 1: Syslog Log Source Parameters for the Huawei S Series Switch DSM

Parameter

Value

Log Source Name

Type a name for your log source.

Log Source Description

Type a description for the log source.

Log Source type

Huawei S Series Switch

Protocol Configuration

Syslog

Log Source Identifier

Type the IP address, host name, or name for the log source as an identifier for your Huawei S Series Switch.

Each log source that you create for your Huawei S Series Switch must include a unique identifier, such as an IP address or host name.

Configuring Your Huawei S Series Switch

To forward syslog events to JSA, you must configure your Huawei S Series Switch as an information center, then configure a log host.

The log host you create for your Huawei S Series Switch can forward events to your JSA console or an Event Collector.

  1. Log in to your Huawei S Series Switch command-line Interface (CLI).

  2. Type the following command to access the system view:

    system-view

  3. Type the following command to enable the information center:

    info-center enable

  4. Type the following command to send informational level log messages to the default channel:

    info-center source default channel loghost log level informational debug state off trap state off

  5. Optional: To verify your Huawei S Series Switch source configuration, type the command:

    display channel loghost

  6. Type the following command to configure the IP address for JSA as the log host for your switch:

    info-center loghost <IP address> facility <local>

    Where:

    • <IP address> is the IP address of the JSA console or Event Collector.

    • <local> is the syslog facility, for example, local0.

    For example,

    info-center loghost 10.10.10.1 facility local0

  7. Type the following command to exit the configuration:

    quit

    The configuration is complete. You can verify events that are forwarded to JSA by viewing events on the Log Activity tab.

Sample Event Message

Use this sample event message to verify a successful integration with JSA.

Huawei S Series Switch sample message when you use the Syslog protocol.

Note:

Due to formatting, paste the message format into a text editor and then remove any carriage return or line feed characters.

The following event shows that the source MAC address in the ARP packet is invalid.

Table 2: Highlighted Fields

JSA Field Name

Highlighted Payload Field Name

Event ID

SECE/3/ARPS_DROP_PACKET_SRC_MAC

The Event ID is extracted from the payload header.

Source IP

SourceIP

The Source IP can be the SourceAddress, SourceIP, or Source fields, which are available in the payload.

Source MAC

SourceMAC

Device Time

May 22 2012 09:43:39

The device time is extracted from the payload header.