Got it
Huawei Enterprise Support Community
Community Forums Routing & Switching
How to change the source ...

How to change the source of logs

Created: Feb 20, 2021 20:22:53Latest reply: Nov 19, 2021 14:49:47 639 8 0 0 0
  Rewarded HiCoins： 5 (problem resolved)
View the author 1#

Hi


Is it possible to change the source of logs sent to syslog server to something like sysname or loopback0 address?


I have a Graylog Server that receives logs on port 8514 and 26 Huawei devices (S5720/S6730) that send logs to it:


info-center loghost 172.16.16.231 local-time port 8514


This graph shows the percentage of logs according to source address:


Graylog


But I'm not able to differentiate which log belongs to each Switch Huawei, because all of them sends the source as the month of currently log (in the graph represented by feb).


Source


In the image above, all logs with feb source are from Huawei devices (generated as February source instead of loopback address or sysname). I can not distinguish in the graph if all my Huawei devices generated a portion of 1264 registers from pizza graph (maybe 48 logs of each one of 26 devices) or if one problematic Huawei sent a lot of logs to Graylog Server


Thanks!

S6730-Hloghostinfo-center

Like (0) Dislike (0) Favorite(0) Share Report
Previous: LLDP_INTERFACE_REM_CHANG error occurred on CE12800
Next: Experience with Huawei Routers
Featured Answers

Best answer

Recommended answer

(1) (0)
Popeye_Wang
Admin Created Feb 21, 2021 01:28:16

Hello,

You can use the info-center loghost source command to configure the source interface used by the Switch to send information to a log host.

Example

# Specify Loopback0 IP address as the source interface address to send information to a log host.

<HUAWEI> system-view

[HUAWEI] interface loopback 0

[HUAWEI-LoopBack0] ip address 10.1.1.1 255.255.255.0

[HUAWEI-LoopBack0] quit

[HUAWEI] info-center loghost source loopback 0


View more
  • x
  • convention：

sabahshahzad
sabahshahzad Created Oct 21, 2021 16:23:09 (0) (0)
 
sabahshahzad
sabahshahzad Created Oct 21, 2021 16:23:16 (0) (0)
 
All Answers
(1) (0)
2#
Popeye_Wang
Popeye_Wang Admin Created Feb 21, 2021 01:28:16

Hello,

You can use the info-center loghost source command to configure the source interface used by the Switch to send information to a log host.

Example

# Specify Loopback0 IP address as the source interface address to send information to a log host.

<HUAWEI> system-view

[HUAWEI] interface loopback 0

[HUAWEI-LoopBack0] ip address 10.1.1.1 255.255.255.0

[HUAWEI-LoopBack0] quit

[HUAWEI] info-center loghost source loopback 0


View more
  • x
  • convention：

sabahshahzad
sabahshahzad Created Oct 21, 2021 16:23:09 (0) (0)
 
sabahshahzad
sabahshahzad Created Oct 21, 2021 16:23:16 (0) (0)
 
(0) (0)
3#
ptomasi
ptomasi Created Feb 22, 2021 03:25:56

Thank you @Popeye_Wang  


I tried that, but it didn't work


#
info-center loghost source LoopBack0
info-center loghost 172.16.16.231 port 8514
#


Loopback0 has 10.0.0.7/32 IP address assigned.


Logs still are received as current month as source:


graylog


Software = S6730 V200R019C10SPC500

Patch = V200R019SPH010


Thanks!

View more
  • x
  • convention：
(0) (0)
4#
Popeye_Wang
Popeye_Wang Admin Created Feb 22, 2021 08:11:12

Posted by ptomasi at 2021-02-22 03:25 Thank you @Popeye_Wang  I tried that, but it didn't work# info-center loghost source LoopBack0 i ...
This may be a problem with your server resolution rules. The month field is incorrectly extracted as 'source'. You may need to check the server configuration.
View more
  • x
  • convention：
(0) (0)
5#
ptomasi
ptomasi Created Feb 22, 2021 12:56:25

I'll check if Graylog Server allows pre-processing of those messages to extract the source from the message itself

Thank you!


---


EDIT:


Graylog community (thanks to @cawfehman member) helped me to solve it:


Graylog


Graylog Server needs a Raw UDP Input to process the data received from Huawei.


---


@Popeye_Wang  the source address worked perfectly, thank you!


info-center loghost source LoopBack0
info-center loghost 172.16.16.231 port 8585


Now all logs are has source from loopback0 address of each device (10.0.0.7 in this example):


Graylog Source


View more
  • x
  • convention：
(0) (0)
6#
lucian2003
lucian2003 Created Feb 24, 2021 16:21:31

Interesting
View more
  • x
  • convention：
(0) (0)
7#
Unicef
Unicef MVE Created Nov 19, 2021 14:49:47

Good answer
View more
  • x
  • convention：
Back to list

Comment

Advanced
B Color Image Link Quote Code Smilies
You need to log in to comment to the post Login | Register
Comment

Notice: To protect the legitimate rights and interests of you, the community, and third parties, do not release content that may bring legal risks to all parties, including but are not limited to the following:
  • Politically sensitive content
  • Content concerning pornography, gambling, and drug abuse
  • Content that may disclose or infringe upon others ' commercial secrets, intellectual properties, including trade marks, copyrights, and patents, and personal privacy
Do not share your account and password with others. All operations performed using your account will be regarded as your own actions and all consequences arising therefrom will be borne by you. For details, see " User Agreement."

My Followers

Login and enjoy all the member benefits

Login
Huawei Website Support About Huawei Privacy User Agreement Terms of Use Cookies Cookie Settings
Huawei Enterprise Huawei Carrier Forum Training & Certification

Contact Us: e_online@huawei.com Copyright © 2022 Huawei Technologies Co., Ltd. All rights reserved.

APP

Block
Are you sure to block this user?
Users on your blacklist cannot comment on your post,cannot mention you, cannot send you private messages.
Reminder
Please bind your phone number to obtain invitation bonus.