Information Output Format
Log output format
The SYSLOG protocol uses UDP port 514 to transmit log messages. Any UDP packet on port 514 is considered a log message. The output format of a log message is shown in Figure 9-2. The log format on a switch is shown in Figure 9-2.The fields in a log are described as follows:Field
Description
TimeStamp
UTC
It is the time when a log message is generated and sent to the log host. By default, it is the coordinated universal time (UTC), which can be configured to the host time.
TimeStamp and HostName are separated by a space.
HostName
It is the system name of a local host. The default HostName is HUAWEI.
HostName and ModuleName are separated by a space.
Huawei Identity
%% refers to the identity of Huawei, indicating that the log is produced by a Huawei product.
Version
dd is a two-digit number starting from 01. It specifies the version of a log format.
ModuleName
It specifies the module that generates log messages. ModuleName and Severity are separated by a slash (/).
Severity
Log messages are classified into eight severity levels, ranging from 0 to 7.
Severity and Brief are separated by a slash (/).
Brief
It is a phrase that summarizes information. Also known as alias.
Log Flag
The flag and Description are separated by a colon (:).
- l: Log
- t: Trap
- d: Debug
- s: Securitylog
Count
It specifies the log serial number.
Slot=A,Vcpu=B
It indicates the system component ID to which a log belongs. The Slot and Vcpu fields are optional and are not involved in each log. The output format varies depending on the actual situation.
Description
It is a string of characters that describe a detailed log message. It is output by a module to the information center. It is filled in by a module at each output time.
Trap output format
Figure 9-3 shows the trap output format.The fields in a trap are described as follows:
Field
Description
#
Information type: # indicates the alarm information.
TimeStamp
It is the time when an alarm message is generated. It is a variable of the date type and expressed in the format Mmm dd yyyy hh:mm:ss.
- Mmm indicates a month. It can be Jan, Feb, Mar, Apr, May, Jun, Jul, Aug, Sep, Oct, Nov, or Dec.
- dd indicates a date of a month. If the value is less than 10, it is expressed as "(blank)date". For example, " 7".
- hh:mm:ss indicates the local time. hh ranges from 00 to 23. mm or ss ranges from 00 to 59.
- yyyy indicates a year.
TimeStamp and HostName are separated by a space.
HostName
It is the system name of a local host.
HostName and ModuleName are separated by a space.
ModuleName
It specifies the module that generates alarm messages. ModuleName and Severity are separated by a slash (/).
Severity
Alarm messages are classified into six severity levels.
Severity and Brief are separated by a slash (/).
Brief
It is a phrase that summarizes information. Also known as alias.
There should be a colon (:) between the Brief field and the Description field.
Description
It is a string of characters that describe a detailed alarm message. It is output by a module to the information center. It is filled in by a module at each output time.
