Enabling Load Balancing For Flow Log Entries; Configuring The Timestamp Of Flow Logs - H3C SR6600-X Configuration Manual

H3C recommends that you use a Loopback interface's address as the source IP address for flow log
packets. A Loopback interface is always up. The setting avoids export failure on interfaces that might go
down.
To configure the source IP address for flow log packets:
Step
1. Enter system view.
2. Specify a source IP address
for flow log packets.

Enabling load balancing for flow log entries

By default, the device sends a copy of each flow log entry to all available log hosts. When one log host
fails, other log hosts still have complete flow log entries.
In load balancing mode, flow log entries are distributed among log hosts based on the source IP
addresses (before NAT) that are recorded in the entries. The flow log entries generated for the same
source IP address are sent to the same log host. If a log host goes down, the flow logs sent to it will be
lost.
To enable load balancing for flow log entries:
Step
1. Enter system view.
2. Enable load balancing for
flow log entries.

Configuring the timestamp of flow logs

The device uses either the local time or the UTC time in the timestamp of flow logs.
UTC time—Standard Greenwich Mean Time (GMT).
•
• Local time—Standard GMT plus or minus the time zone offset.
The time zone offset can be configured by using the clock timezone command. For more
information, see Fundamentals Configuration Guide.
By default, the UTC time is used.
To configure the device to use the local time in the flow log timestamp:
Step
1. Enter system view.
2. Configure the device to use
the local time in the flow log
timestamp.
Command
system-view
userlog flow export source-ip
ip-address
Command
system-view
userlog flow export
load-balancing
Command
system-view
userlog flow export timestamp
localtime
262
Remarks
N/A
By default, the source IP address
for flow log packets is the IP
address of their outgoing interface.
Remarks
N/A
By default, load balancing is
disabled.
Remarks
N/A
By default, the UTC time is used in
the flow log timestamp.