The FW can output logs only after the information center is enabled.
system-view
info-center enable
When the information center is enabled and the system is busy sorting and outputting information, system performance is affected.
info-center channel channel-number name channel-name
Each information channel must have a unique name, and the channel names must represent the actual channel functions.
info-center timestamp log { boot | { date | short-date | format-date } [ second | precision-time { tenth-second | millisecond } ] } [ without-timezone ]
The default log timestamp format is date.
info-center filter-id { id | bymodule-alias modname alias } &<1-50> [ bytime interval | bynumber number ]
Currently, only 50 IDs can be shielded. The aggregation of these shielded IDs is called a log ID filtering list. The log ID filtering list is arranged by ID values.
During the running of a device, if too many logs with the same log ID are generated, the information center is too busy processing these logs to process logs with other log IDs, which may even affect the running service. The information center monitors the traffic of logs with different log IDs. When the traffic of logs with a specific log ID repeatedly exceeds the threshold during the monitoring period, the information center suppresses the processing rate of these specified logs by processing only the conforming traffic and discarding the non-conforming traffic; when the traffic of logs with the specific log ID falls below the threshold and remains below the threshold for five monitoring periods, the suppression is removed.
info-center statistic-suppress enable
On the FW, service modules generate logs and control the volume of generated logs. The information center processes the received logs.
Service modules, such as ARP and VRRP produce large numbers of duplicate logs in short periods in some scenarios. In this case, you can enable the statistical output of consecutive duplicate logs to prevent the information center from the failure in processing other logs.
Consecutive duplicate logs have the same ID and parameters, and they do not have two or more other logs in between.
info-center loghost vsys-to-public enable
If the FW has multiple virtual systems, it needs to use multiple interfaces to send syslogs service log. If the interfaces are insufficient, configure multiple routes to the public system. Then run the info-center loghost vsys-to-public enable command to enable the function of sending the logs of all virtual systems to the log host of the public system.