https://www.cnblogs.com/jiyanfeng/p/17606513.html
https://www.cnblogs.com/daynote/p/8996160.html
1. 华为交换机配置
# 更改时区
clock timezone BeiJing add 08:00:00
(or clock timezone cst add 8)
# 时间同步
ntp-service unicast-server 203.107.6.88
# 日志中心
info-center enable
info-center timestamp log format-date precision-time second
info-center loghost 192.168.2.96 facility local6 # 指定设备类型local6
info-center loghost source Vlanif1 # 指定日志消息本地发送接口
# 调试
display clock
display ntp-service status
display info-center
display channel 2
2. 服务器rsyslog配置
/etc/rsyslog.conf
# 日志格式模板
$template CustomFormat, "%timegenerated:1:23:date-rfc3339% | %syslogfacility-text% | %fromhost-ip% | %syslogseverity-text%
| %msg%\n"
# 日志文件模板
$template RemoteLog, "/var/log/rsyslog/%fromhost-ip%.log"
# 不写入本地日志
:fromhost-ip, !isequal, "127.0.0.1" ?RemoteLog;CustomFormat
3. 防火墙安全策略
untrust -> trust any to any 514 : permit
local -> trust any to any 514 : permit
4. 删除无需处理的log日志
2020-5-8 21:48:31+08:00 Huawei %%01NTP/4/PACKET_LENGTH_WRONG(l)[42]:The received NTP packet is longer than or shorter than a valid packet. (RcvLen=5)
提示含义：接收到的NTP报文长度超过合法报文的最大长度或者小于合法报文的最小长度。
处理步骤：正常运行信息，无需处理。
解决方法： info-center filter-id bymodule-alias ntp PACKET_LENGTH_WRONG //此处只需写对应的告警前缀即可，执行该命令后，设备不会继续反馈这种无需处理的告警log日志。
参考资料：https://support.huawei.com/enterprise/zh/knowledge/EKB1001995724
