ArubaOS 8.6.0.0 Help Center
You are here: Home > Management Access > Configuring Logging

Configuring Logging

This section outlines the steps required to configure logging on a managed device.

For each category or subcategory of message, you can set the logging level or severity level of the messages to be logged. Table 1 summarizes these categories:

Table 1: Software Modules

Category or Subcategory

Description

Network

Network messages

all

All network messages

packet-dump

Protocol packet dump messages

mobility

Mobility messages

dhcp

DHCPDynamic Host Configuration Protocol. A network protocol that enables a server to automatically assign an IP address to an IP-enabled device from a defined range of numbers configured for a given network.  messages

System

System messages

all

All system messages

configuration

Configuration messages

messages

Messages

snmp

SNMPSimple Network Management Protocol. SNMP is a TCP/IP standard protocol for managing devices on IP networks. Devices that typically support SNMP include routers, switches, servers, workstations, printers, modem racks, and more. It is used mostly in network management systems to monitor network-attached devices for conditions that warrant administrative attention.  messages

webserver

Web server messages

security

Security messages

all

All security messages

aaa

AAAAuthentication, Authorization, and Accounting. AAA is a security framework to authenticate users, authorize the type of access based on user credentials, and record authentication events and information about the network access and network resource consumption. messages

firewall

FirewallFirewall is a network security system used for preventing unauthorized access to or from a private network. messages

packet-trace

Packet trace messages

mobility

Mobility messages

vpn

VPNVirtual Private Network. VPN enables secure access to a corporate network when located remotely. It enables a computer to send and receive data across shared or public networks as if it were directly connected to the private network, while benefiting from the functionality, security, and management policies of the private network. This is done by establishing a virtual point-to-point connection through the use of dedicated connections, encryption, or a combination of the two. messages

dot1x

802.1X802.1X is an IEEE standard for port-based network access control designed to enhance 802.11 WLAN security. 802.1X provides an authentication framework that allows a user to be authenticated by a central authority. messages

webserver

Web server messages

Wireless

Wireless messages

all

All wireless messages

User

User messages

all

All user messages

captive-portal

Captive portalA captive portal is a web page that allows the users to authenticate and sign in before connecting to a public-access network. Captive portals are typically used by business centers, airports, hotel lobbies, coffee shops, and other venues that offer free Wi-Fi hotspots for the guest users. user messages

vpn

VPNVirtual Private Network. VPN enables secure access to a corporate network when located remotely. It enables a computer to send and receive data across shared or public networks as if it were directly connected to the private network, while benefiting from the functionality, security, and management policies of the private network. This is done by establishing a virtual point-to-point connection through the use of dedicated connections, encryption, or a combination of the two. messages

dot1x

802.1X802.1X is an IEEE standard for port-based network access control designed to enhance 802.11 WLAN security. 802.1X provides an authentication framework that allows a user to be authenticated by a central authority. messages

radius

RADIUSRemote Authentication Dial-In User Service. An Industry-standard network access protocol for remote authentication. It allows authentication, authorization, and accounting of remote users who want to access network resources.  user messages

For each category or subcategory, you can configure a logging level. Table 2 describes the logging levels in order of severity, from most to least severe.

Table 2: Logging Levels

Logging Level

Description

Emergency

Panic conditions that occur when the system becomes unusable.

Alert

Any condition requiring immediate attention and correction.

Critical

Any critical conditions such as a hard drive error.

Errors

Error conditions.

Warning

Warning messages.

Notice

Significant events of a non-critical and normal nature.

Informational

Messages of general interest to system users.

Debug

Messages containing information useful for debugging.

The default logging level for all categories is Warning. You can also configure IP address of a syslog server to which the managed device can direct these logs.

The following procedure describes how to configure the IP address of a syslog server to which the managed device can direct these logs.

1. In the Managed Network node hierarchy, navigate to the Configuration > System > Logging > Syslog Servers page.

2. To add a logging server, click + in the Syslog Servers section.

3. Enter the IP address and the Port number.

4. Add the logging server to the list of logging servers. Ensure that the syslog server is enabled and configured on this host. Click Apply.

5. To select the types of messages you want to log, select Logging Levels .

6. Select the category or subcategory to be logged.

7. To select the severity level for the category or subcategory, select the level from the Logging Level drop-down list.

8. Select the logging format CEF or BSD-standard from the Format drop-down list.

 

The ArcSight CEFCommon Event Format. The CEF is a standard for the interoperability of event or log-generating devices and applications. The standard syntax for CEF includes a prefix and a variable extension formatted as key-value pairs. is a log management standard that uses a standardized logging format so that data can easily be collected and aggregated for analysis by an enterprise management system.

9. Click Submit.

10. Click Pending Changes.

11. In the Pending Changes window, select the check box and click Deploy changes.

The following CLICommand-Line Interface. A console interface with a command line shell that allows users to execute text input as commands and convert these commands to appropriate functions. commands configure the IP address of a syslog server to which the managed device can direct these logs.

logging <ipaddr>

logging level <level> <category> [subcat <subcategory>]

Syslog operates over UDPUser Datagram Protocol. UDP is a part of the TCP/IP family of protocols used for data transfer. UDP is typically used for streaming media. UDP is a stateless protocol, which means it does not acknowledge that the packets being sent have been received. and is connectionless. Therefore, it is not possible for the managed device to recognize a failure of the syslog server or the network path to the syslog server. By establishing an IPsecInternet Protocol security. IPsec is a protocol suite for secure IP communications that authenticates and encrypts each IP packet in a communication session. tunnel between the managed device and the syslog server, (see Planning a VPN Configuration) it is possible to indirectly track the status of the syslog server link.

After a failure occurs, the network administrator has to manually re-synchronize log files by copying them from the managed device to the syslog server. Use the tar logs CLICommand-Line Interface. A console interface with a command line shell that allows users to execute text input as commands and convert these commands to appropriate functions. command to create an archive of all local logs, then use the copy CLICommand-Line Interface. A console interface with a command line shell that allows users to execute text input as commands and convert these commands to appropriate functions. command to copy this archive to an external server. Log space is limited on the managed device, and depending on how long the outage lasted some local logs may be overwritten.

/*]]>*/