Configuring Session Logging; Enabling Session Logging; Setting Session Logging Thresholds - HP 6600 Security Configuration Manual

Configuring session logging

Session logs help track information about user access, IP address translation, and traffic, and can be sent
to the log server or exported to the information center in flow log format. It can help network
administrators in security auditing.
VLAN interfaces do not support session logging.

Enabling session logging

Step
1. Enter system view.
Enter interface view.
2.
3. Enable session logging.

Setting session logging thresholds

You can set thresholds to trigger recording and outputting session logs. The thresholds include:
• Holdtime threshold—The system outputs a session log when the holdtime of a session reaches the
preset threshold.
Traffic threshold—The system outputs a session log when the number of packets or byte count of a
•
session reaches the preset threshold.
If you specify both the holdtime threshold and traffic threshold, the system performs session logging
according to the threshold that is first reached, and then clears all statistics.
If you specify both the packet count threshold and byte count threshold, only the one specified last takes
effect.
To set session logging thresholds:
Step
1. Enter system view.
2. Set the holdtime threshold
for session logging.
3. Configure the traffic
threshold for session
logging.
Command
system-view
interface interface-type interface-number
session log enable [ acl acl-number ]
{ inbound | outbound }
Command
system-view
session log time-active time-value
•
Set the packet count threshold:
session log packets-active
packets-value
•
Set the byte count threshold:
session log bytes-active bytes-value
458
Remarks
N/A
N/A
Disabled by default.
Only basic and advanced IPv4
ACLs are supported.
Remarks
N/A
Optional.
0 by default, which means that
the system does not output
session logs based on session
holdtime threshold.
Optional.
0 by default, which means that
the system does not output
session logs based on packet
count threshold or byte count
threshold.