Example for Outputting SSL-Encrypted Logs to a Log Host

Procedure

1. Configure an SSL client policy.

   <HUAWEI> system-view
   [~HUAWEI] sysname SwitchA
   [*HUAWEI] commit
   [~SwitchA] ssl policy syslog_client
   [*SwitchA-ssl-policy-syslog_client] trusted-ca load pem-ca 1_cacert_pem_rsa.pem
   [*SwitchA-ssl-policy-syslog_client] trusted-ca load pem-ca 1_rootcert_pem_rsa.pem
   [*SwitchA-ssl-policy-syslog_client] commit
   [~SwitchA-ssl-policy-syslog_client] quit
   

   After the configuration is complete, run the display ssl policy command on SwitchA to view detailed information about the trusted-CA files that have been loaded.

   [~SwitchA] display ssl policy
   
          SSL Policy Name: syslog_client 
        Policy Applicants: 
            Key-pair Type:
    Certificate File Type:
         Certificate Type:
     Certificate Filename:
        Key-file Filename:
                 CRL File:
          Trusted-CA File:
        Trusted-CA File 1: Format = PEM, Filename = 1_cacert_pem_rsa.pem
        Trusted-CA File 2: Format = PEM, Filename = 1_rootcert_pem_rsa.pem

2. Enable the information center.

   [~SwitchA] info-center enable
   [*SwitchA] commit
   

3. Configure a channel and a rule for outputting logs to a log host.

   # Name a channel.

   [~SwitchA] info-center channel 6 name loghost1
   [*SwitchA] info-center channel 7 name loghost2
   [*SwitchA] commit
   

   # Configure a channel for outputting logs to a log host.

   [~SwitchA] info-center loghost 10.1.1.1 channel loghost1 transport tcp ssl-policy syslog_client
   [*SwitchA] info-center loghost 10.1.1.2 channel loghost1 transport tcp ssl-policy syslog_client
   [*SwitchA] info-center loghost 10.2.1.1 channel loghost2 transport tcp ssl-policy syslog_client
   [*SwitchA] info-center loghost 10.2.1.2 channel loghost2 transport tcp ssl-policy syslog_client
   [*SwitchA] commit
   

   # Configure a rule for outputting logs to a log host.

   [~SwitchA] info-center source arp channel loghost1 log level notification
   [*SwitchA] info-center source aaa channel loghost2 log level warning
   [*SwitchA] commit
   

4. Specify the source interface for sending logs.

   # Specify the source interface for sending logs.

   [~SwitchA] info-center loghost source vlanif 100
   [*SwitchA] commit
   

5. Configure the log host on the server.

   The device can generate many logs, which may exceed the limited storage space of the device. To address this problem, configure a log host to store all the logs.

   The log host can run the Unix or Linux operating system or run third-party log software. For details about the configuration procedure, see the relevant documentation.

6. Verify the configuration.

   # View the configured lost host.

   [~SwitchA] display info-center
   Information Center:enabled
   Log host: 
           10.1.1.1, channel number 6, channel name loghost1,
   language English , host facility local7, transport tcp ssl-policy syslog_client
           10.1.1.2, channel number 6, channel name loghost1, 
   language English , host facility local7, transport tcp ssl-policy syslog_client
           10.2.1.1, channel number 7, channel name loghost2,
   language English , host facility local7, transport tcp ssl-policy syslog_client
           10.2.1.2, channel number 7, channel name loghost2, 
   language English , host facility local7, transport tcp ssl-policy syslog_client
   Console: 
           channel number : 0, channel name : console 
   Monitor: 
           channel number : 1, channel name : monitor  
   SNMP Agent:  
           channel number : 5, channel name : snmpagent 
   Log buffer:  
           enabled,max buffer size 10240, current buffer size 512,
   current messages 316, channel number : 4, channel name : logbuffer 
   dropped messages 0, overwritten messages 0
   Trap buffer: 
           enabled,max buffer size 1024, current buffer size 256,
   current messages 256, channel number:3, channel name:trapbuffer
   dropped messages 0, overwritten messages 53
   logfile: 
           channel number : 9, channel name : channel9, language : English
   Information timestamp setting:
           log - date, trap - date, debug - date millisecond