Information Output Format

Log output format

The SYSLOG protocol uses UDP port 514 to transmit log messages. Any UDP packet on port 514 is considered a log message. The output format of a log message is shown in Figure 1. The log format on a switch is shown in Figure 1.

Figure 1 Output format of a Log message

The fields in a log are described as follows:

Field	Description
TimeStamp UTC	It is the time when a log message is generated and sent to the log host. By default, it is the coordinated universal time (UTC), which can be configured to the host time. TimeStamp and HostName are separated by a space.
HostName	It is the system name of a local host. The default HostName is HUAWEI. HostName and ModuleName are separated by a space.
Huawei Identity	%% refers to the identity of Huawei, indicating that the log is produced by a Huawei product.
Version	dd is a two-digit number starting from 01. It specifies the version of a log format.
ModuleName	It specifies the module that generates log messages. ModuleName and Severity are separated by a slash (/).
Severity	Log messages are classified into eight severity levels, ranging from 0 to 7. Severity and Brief are separated by a slash (/).
Brief	It is a phrase that summarizes information.
Log Flag	The flag and Description are separated by a colon (:). l: Log t: Trap d: Debug s: Securitylog
Count	It specifies the log serial number.
Slot=A,Vcpu=B	It indicates the system component ID to which a log belongs. The Slot and Vcpu fields are optional and are not involved in each log. The output format varies depending on the actual situation.
Description	It is a string of characters that describe a detailed log message. It is output by a module to the information center. It is filled in by a module at each output time.

Trap output format

Figure 2 shows the trap output format.

Figure 2 Trap output format

The fields in a trap are described as follows:

Field	Description
#	Information type: # indicates the alarm information.
TimeStamp	It is the time when an alarm message is generated. It is a variable of the date type and expressed in the format Mmm dd hh:mm:ss yyyy. Mmm indicates a month. It can be Jan, Feb, Mar, Apr, May, Jun, Jul, Aug, Sep, Oct, Nov, or Dec. dd indicates a date of a month. If the value is less than 10, it is expressed as "(blank)date". For example, " 7". hh:mm:ss indicates the local time. hh ranges from 00 to 23. mm or ss ranges from 00 to 59. yyyy indicates a year. TimeStamp and HostName are separated by a space.
HostName	It is the system name of a local host. HostName and ModuleName are separated by a space.
ModuleName	It specifies the module that generates alarm messages. ModuleName and Severity are separated by a slash (/).
Severity	Alarm messages are classified into six severity levels. Severity and Brief are separated by a slash (/).
Brief	It is a phrase that summarizes information. There should be a colon (:) between the Brief field and the Description field.
Description	It is a string of characters that describe a detailed alarm message. It is output by a module to the information center. It is filled in by a module at each output time.