eSight LogCenter Manager - Huawei Products
Under Construction!

Prompt

You have not logged in. Want to enter the login page?

Yes No

Prompt

Sorry that you are not authorized to download this document.

Apply Previous

Register an account

  • *
  • *
  • *
  • *
  • *
  • I agree that Huawei representatives may contact me.
  • I agree to receive information on Huawei products by email.
  • Terms of UsePrivacy Policy

If you already have a Huawei account, please login to download

eSight LogCenter Manager

Massive application systems and network devices are deployed in an enterprise, including hosts, databases, other application systems, switches, and firewalls. Due to inconsistent device log formats, low readability, and difficulties storing massive logs, major security risks cannot be promptly detected from logs. Government agencies and industrial organizations provide guidance and stipulations through internal control laws and standards, which impose higher requirements on the completeness, accuracy, and effectiveness of run logs and user logs.
eSight LogCenter: 
Provides a platform for collecting, storing, and auditing multiple types of large-scale logs in a unified manner. 
Supports log management of Huawei and third-party vendors. 
Provides industry-leading NAT tracing function and security event analysis.

Unified Log Management and Quick Matching Capability

  • eSight LogCenter supports multiple log collection modes, including Syslog, session, SFTP, FTP static file, FTP dynamic file, and Windows Management Instrumentation (WMI). Users can collect, classify, filter, summarize, analyze, store, and monitor logs reported from the application systems or NEs to help the administrator manage massive logs and learn NE running status, trace network user behaviors, and quickly recognize and eliminate security risks.
  • eSight LogCenter supports prompt notifications of key logs. The administrator can customize keywords, log type, and log level thresholds. When logs match customized keywords, log type, or log level, eSight LogCenter generates alarms in real time and notifies users through SMS messages or emails.


Professional NAT Tracing and Automatic Association with User information to Meet Secure Audit Requirements

eSight LogCenter collects and analyzes logs about sessions on NAT devices to obtain NAT information, including the IP address, destination port, NAT source IP address, and protocols. eSight LogCenter uses the NAT information and the data source provided by the Authentication, Authorization and Accounting (AAA) server to ensure secure audit and traffic investigation.



Profound User Online Behavior Analysis

eSight LogCenter works with Huawei USG and ASG devices to analyze user online behaviors, including user traffic, online time, keywords, web access trends, emails, applications, network threats, and outgoing files.



Rich Security Event Analysis Reports Showing Network Security Status

eSight LogCenter collects security event logs about network security devices and systems, such as Huawei network UTM system, firewalls, intrusion protection system, and Anti-DDoS system, analyzes them, and generates reports to help users learn the network security status. eSight LogCenter supports DDoS attack event analysis, plug-in block analysis, access control event analysis, policy matching analysis, IPS analysis, URL filter analysis, and email filter analysis.



Million-level Log Processing per Second, Meeting Requirements of State-level Network Auditing

eSight LogCenter meets the performance requirements of state-level network auditing and collects and audits millions of system logs in a second, supporting high-performance log collection, storage, and audit functions for large and ultra large networks.


eSight LogCenter Manager can be deployed on the same server as eSight Unified Network Management Platform standard or professional edition, or on a different one. When they are configured on different servers, configuration requirements are as follows:


Operating System Configuration Requirement
Windows Server 2008 R2 standard CPU: 1 x hexa-core 2 GHz or higher
Memory: 8 GB
Disk space: 36 TB (The recommended available disk space is 33 TB.)
Database: MySQL 5.5, Microsoft SQL Server 2008 R2 standard

PC servers are recommended.
LogCenter supports distributed deployment. Determine the hardware specifications and the number of servers based on the network scale.

eSight LogCenter network can be deployed in centralized or distributed ways.


Distributed deployment: The Log Collector and the Log Analyzer are deployed separately on two servers.


Log Collector: Receives, summarizes, formats, filters, counts, and stores logs and generates alarms.


Log Analyzer: Manages policies, reports, devices, systems, and users.


Log Console: Provides an interaction GUI for managing foreground and background using the web.


Centralized deployment: When performance requirements are low, eSight LogCenter can also be deployed in a centralized way.


When fewer than 2,000 logs are managed every second in an SMB project, eSight LogCenter and an eSight application base can be deployed on the same server.


Description Quantity Range Remarks
Basic log management functions on eSight LogCenter (including a small-scale log management license) 1 Mandatory
Extended eSight LogCenter management function components (including third-party device log management and identity association) 0 or 1 Optional. Extended functions include third-party device log management and identity association.
eSight LogCenter log management function promotion packages 0 or 1 Optional. The basic and expansible packages are included.
Small-scale log management license (managing 250 Syslog logs every second for about 25 devices, tracing 1,250 NAT logs with 250 Mbit/s outgoing bandwidth, and supporting 250 GB storage for about 60 days) Optional Optional. The log management capability is controlled by EPS (that is, the number of logs collected every second). The value is calculated assuming that 10 Syslog logs are collected on each device every second, and five session logs are generated on 1 Mbit/s bandwidth every second. Project requirements in most scenarios can be met. Requirements can also be adjusted if customer requirements are decreased or increased. For example, if most devices on the user network are switches, which send fewer Syslog logs, a small-scale package can manage a network consisting of 100 NEs; however, if the user network outgoing bandwidth is 200 Mbit/s, while more than 2,000 sessions are generated each second, two small-scale packages can be used as required.
Medium-scale log management license (managing 1,000 Syslog logs every second for about 100 devices, tracing 5,000 NAT logs with 1 Gbit/s outgoing bandwidth, and supporting 1 TB storage for about 60 days) Optional
Large-scale log management license (managing 2,500 Syslog logs every second for about 250 devices, tracing 125,000 NAT logs with 2.5 Gbit/s outgoing bandwidth, and supporting 2.5 TB storage for about 60 days) Optional
Storage expansion license for log management components of eSight LogCenter-1 TB Configured only on one Log Collector Optional The log storage expansion license is optional.
Storage expansion license for log management components of eSight LogCenter-10 TB Configured only on one Log Collector Optional
Storage expansion license for log management components of eSight LogCenter-30 TB Configured only on one Log Collector Optional

DOCUMENTATION CENTER NEWS ROOM CASE STUDIES VIDEO ZONE PUBLICATIONS SHARE