HUAWEI-USERLOG-MIB

All MIBs › HUAWEI-USERLOG-MIB

Organization: Huawei Technologies co.,Ltd.

Last Updated: 2003-04-10

Category: Domain: Subscriber Management, Technology: Logging/Syslog, Vendor: Huawei

Description: Huawei user log MIB for collecting NAT session logs, flow records, and subscriber activity logs for audit and compliance.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is HUAWEI-USERLOG-MIB?

HUAWEI-USERLOG-MIB is a Huawei enterprise MIB supporting the "user log" feature, which records Network Address Translation (NAT) flow information for subscribers accessing the network through NAT and Broadband Access Server (BAS) equipment, addressing the problem that dynamically assigned IP addresses make it hard to trace which user initiated a given session. It exposes configuration objects for enabling and tuning user-log collection along with running-state objects reflecting the feature's operational status. Its monitoring value is mostly software/service state: verifying the user-log feature is actively running and successfully generating NAT flow/session records needed for audit, compliance, and lawful-intercept-style traceability. It works in conjunction with the device's underlying NAT and BAS subscriber-management functionality, on which its logged data depends. Deployment context is carrier broadband access networks (BRAS/NAT gateways) where regulatory or security requirements mandate traceable subscriber-to-session mapping, and network engineers can complete a HUAWEI-USERLOG-MIB download to load its definitions into their MIB browser or NMS.

IPNetwork Monitor allows you to monitor SNMP objects defined in HUAWEI-USERLOG-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

Huawei BRAS
Huawei NAT gateway
Huawei broadband access device

Monitoring Examples

An administrator would poll the user-log feature's running-state object to confirm log generation is active, and would monitor NAT flow/session record counters to detect gaps in logging that could compromise the ability to trace a subscriber's NAT-translated session for compliance purposes.

What Can Be Monitored

user-log feature running state
NAT flow record generation
subscriber session logging status

Imported Objects

From HUAWEI-MIB

hwDatacomm

OBJECT-IDENTITY

From SNMPv2-CONF

MODULE-COMPLIANCE
OBJECT-GROUP

From SNMPv2-SMI

Counter32
Integer32
IpAddress
MODULE-IDENTITY
OBJECT-TYPE

How to Use in IPNetwork Monitor

Example using hwUserlogNatTotalEntries OID:

Select a Huawei BRAS/NAT gateway/broadband access device (subscriber NAT user log) as the target host to create a monitor — the SNMP service should be up and running on it. Click New Monitor, then check SNMP Custom on the Favorites tab, click Next, and confirm the host. On the next page, click Select... to open the built-in SNMP MIB Browser and type hwUserlogNatTotalEntries into the Find box to locate it in the OID tree, selecting the specific row/instance you want to monitor since this is a table column, then select it and click OK. The total number of NAT flow entries which are logged. On the monitor's Main parameters page you can set the target's SNMP port (default 161), credentials, polling interval, and other settings — see the SNMP Monitor help for details. On the State conditions and Alerting tabs, configure when the monitor should change state and trigger an alert; since this is a Counter32-type OID, Value bounds is the most useful condition here — trigger an alert if the counter increases sharply between polls relative to its normal baseline, since an unexpected spike often reflects a real change in traffic or activity. Click Finish to create the monitor; you can adjust any parameter later.

OIDs

OID symbolic	OID numeric	Type	Access	Description
hwUserLogMIB	1.3.6.1.4.1.2011.5.25.18			The HUAWEI-USERLOG-MIB contains objects to manage configuration and monitor running state for userlog feature. For users who access network through NAT and BAS equipments, their IP addresses are generally unfixed, and so it is hard to exactly locate which host a certain access comes from and which user initiates it. This decreases the network security. User log is designed to solve the problem. User log can record Network Address Translation (NAT) flow information, and login/ logout information and flow information of Broadband Access Server (BAS) user, thus enabling the administrator know address information before NAT, access record of BAS user, etc. Then, network activities and operations can be queried and tracked, and network availability and security are improved accordingly.
hwUserlogObjects	1.3.6.1.4.1.2011.5.25.18.1
hwUserlogNatObjects	1.3.6.1.4.1.2011.5.25.18.1.1
I32 hwUserlogNatVersion	1.3.6.1.4.1.2011.5.25.18.1.1.1	Integer32	read-only	NAT LOG version. Currently only version 1 is developed.
I32 hwUserlogNatSyslog	1.3.6.1.4.1.2011.5.25.18.1.1.2	Integer32	read-write	NAT LOG format. If 1, LOG format is sysLog. If 0, LOG format is UDP packet. UDP packet is the default format and is recommended. Syslog can be used in the case that log amount is not too large.
IP hwUserlogNatSourceIP	1.3.6.1.4.1.2011.5.25.18.1.1.3	IpAddress	read-write	The Source IP address of NAT LOG UDP packet. By default, the source IP address of the UDP packet is the IP address of the interface through which the router outputs the user log packet. On the user log server side, the source of log information can be located rapidly through identifying the source IP address of the log. You are recommended to configure a loopback address or router ID to function as the source IP address of the UDP packet.
I32 hwUserlogNatFlowBegin	1.3.6.1.4.1.2011.5.25.18.1.1.4	Integer32	read-write	Log the NAT flow when it is created. If 1, this function is enabled. If 0, this function is disabled. This function will be used when real-time monitor is required. The default value 0 means this function is disabled.
I32 hwUserlogNatActiveTime	1.3.6.1.4.1.2011.5.25.18.1.1.5	Integer32	read-write	The active time for long-time existed NAT flow. Unit: minute. Range: 10 minutes ~ 120 minutes. When setting it, NAT flow can be logged after an interval of active time. This function will be used when real-time monitor is required. The default value 0 means real-time monitor function is disabled.
hwUserlogNatSlotCfgInfoTable	1.3.6.1.4.1.2011.5.25.18.1.1.6		not-accessible	A table of NAT LOG configuration information for the specified slot. By default, user log function is disabled on the interface board. Only after user log function is enabled, the other configurations related to user log take effect.
hwUserlogNatSlotCfgInfoEntry	1.3.6.1.4.1.2011.5.25.18.1.1.6.1		not-accessible	NAT LOG configuration information entry for a slot.
I32 hwUserlogNatCfgSlotNumber	1.3.6.1.4.1.2011.5.25.18.1.1.6.1.1	Integer32	read-only	Slot number. The object specifies which slot is configured with NAT LOG. For NAT LOG, it is the slot of the egress interface configured with NAT.
I32 hwUserlogNatEnable	1.3.6.1.4.1.2011.5.25.18.1.1.6.1.2	Integer32	read-write	The NAT LOG feature status. If 1, NAT LOG is enabled. If 0, NAT LOG is disabled. The default value 0 means NAT LOG is disabled.
I32 hwUserlogNatAclNumber	1.3.6.1.4.1.2011.5.25.18.1.1.6.1.3	Integer32	read-write	Access-list number. Its range is 2000 ~ 3999. The value 0 means no ACL is specified. Only when NAT LOG is enabled, and ACL is configured. Only NAT flow which match the ACL will be logged.
IP hwUserlogNatHostAddress	1.3.6.1.4.1.2011.5.25.18.1.1.6.1.4	IpAddress	read-write	The IP address of NAT LOG server. If user log is output in UDP packet mode, user log server must be configured and user log server address must be specified correctly. Otherwise, user log function cannot work normally. The address of the destination server must be a valid unicast address rather than a loop address or multicast address. In principle, it should be the address of the user log server that can communicate normally.
I32 hwUserlogNatUdpPort	1.3.6.1.4.1.2011.5.25.18.1.1.6.1.5	Integer32	read-write	The UDP Port Number of NAT LOG server. Its range is 1 ~ 65535. In order to avoid confliction with general UDP port numbers, you are recommended to use the UDP port number above 1024.
hwUserlogNatSlotRunInfoTable	1.3.6.1.4.1.2011.5.25.18.1.1.7		not-accessible	A table of NAT LOG running information for the specified slot.
hwUserlogNatSlotRunInfoEntry	1.3.6.1.4.1.2011.5.25.18.1.1.7.1		not-accessible	NAT LOG running information entry for a slot.
I32 hwUserlogNatRunSlotNumber	1.3.6.1.4.1.2011.5.25.18.1.1.7.1.1	Integer32	read-only	Slot number. The object specifies on which slot the NAT LOG statistics are calculated.
C32 hwUserlogNatTotalEntriesEx	1.3.6.1.4.1.2011.5.25.18.1.1.7.1.2	Counter32	read-only	The total number of NAT flow entries which are logged.
C32 hwUserlogNatTotalPackets	1.3.6.1.4.1.2011.5.25.18.1.1.7.1.3	Counter32	read-only	The total number of NAT LOG UDP packets generated by the device.
C32 hwUserlogNatFailedEntries	1.3.6.1.4.1.2011.5.25.18.1.1.7.1.4	Counter32	read-only	The total number of NAT flow entries failed in outputting.
C32 hwUserlogNatFailedPackets	1.3.6.1.4.1.2011.5.25.18.1.1.7.1.5	Counter32	read-only	The total number of NAT LOG UDP packets failed in outputting.
I32 hwUserlogNatClearRunStat	1.3.6.1.4.1.2011.5.25.18.1.1.7.1.6	Integer32	read-write	Clears the running statistics for NAT LOG. Its access is write-only. If 1, the running statistics for NAT LOG is resetted. Other value is invalid.
hwUserlogFlowObjects	1.3.6.1.4.1.2011.5.25.18.1.2
I32 hwUserlogFlowVersion	1.3.6.1.4.1.2011.5.25.18.1.2.1	Integer32	read-only	BAS FLOW LOG version. Currently only version 1 is developed.
I32 hwUserlogFlowSyslog	1.3.6.1.4.1.2011.5.25.18.1.2.2	Integer32	read-write	BAS FLOW LOG format. If 1, LOG format is sysLog. If 0, LOG format is UDP packet. UDP packet is the default format, and is recommended. Syslog can be used in the case that log amount is not too large.
IP hwUserlogFlowSourceIP	1.3.6.1.4.1.2011.5.25.18.1.2.3	IpAddress	read-write	The Source IP address of BAS FLOW LOG UDP packet. By default, the source IP address of the UDP packet is the IP address of the interface through which the router outputs the user log packet. On the user log server side, the source of log information can be located rapidly through identifying the source IP address of the log. You are recommended to configure a loopback address or router ID to function as the source IP address of the UDP packet.
I32 hwUserlogFlowFlowBegin	1.3.6.1.4.1.2011.5.25.18.1.2.4	Integer32	read-write	Log the BAS flow when it is created. If 1, this function is enabled. If 0, this function is disabled. This function will be used when real-time monitor is required. The default value 0 means this function is disabled.
I32 hwUserlogFlowActiveTime	1.3.6.1.4.1.2011.5.25.18.1.2.5	Integer32	read-write	The active time for long-time existed BAS flow. Its unit is minute. Its range is 10 minutes ~ 120 minutes. When setting it, BAS flow can be logged after an internal of active time. This function will be used when real-time monitor is required. The default value 0 means real-time monitor function is disabled.
hwUserlogFlowSlotCfgInfoTable	1.3.6.1.4.1.2011.5.25.18.1.2.6		not-accessible	A table of BAS FLOW LOG configuration information for the specified slot. By default, user log function is disabled on the interface board. Only after user log function is enabled, the other configurations related to user log take effect.
hwUserlogFlowSlotCfgInfoEntry	1.3.6.1.4.1.2011.5.25.18.1.2.6.1		not-accessible	BAS FLOW LOG configuration information entry for a slot.
I32 hwUserlogFlowCfgSlotNumber	1.3.6.1.4.1.2011.5.25.18.1.2.6.1.1	Integer32	read-only	Slot number. The ojects specifies which slot is configured with BAS FLOW LOG.
I32 hwUserlogFlowEnable	1.3.6.1.4.1.2011.5.25.18.1.2.6.1.2	Integer32	read-write	The BAS FLOW LOG feature status. If 1, BAS FLOW LOG is enabled. If 0, BAS FLOW LOG is disabled. The default value 0 means BAS FLOW LOG is disabled.
I32 hwUserlogFlowAclNumber	1.3.6.1.4.1.2011.5.25.18.1.2.6.1.3	Integer32	read-write	Access-list number. Its range is 2000 ~ 3999. The value 0 means no ACL is specified. Only when BAS FLOW LOG is enabled, the ACL be configured. Only BAS flow which match the ACL will be logged.
IP hwUserlogFlowHostAddress	1.3.6.1.4.1.2011.5.25.18.1.2.6.1.4	IpAddress	read-write	The IP address of BAS FLOW LOG server. If user log is output in UDP packet mode, user log server must be configured and user log server address must be specified correctly. Otherwise, user log function cannot work normally. The address of the destination server must be a valid unicast address rather than a loop address or multicast address. In principle, it should be the address of the user log server that can communicate normally.
I32 hwUserlogFlowUdpPort	1.3.6.1.4.1.2011.5.25.18.1.2.6.1.5	Integer32	read-write	The UDP Port Number of BAS FLOW LOG server. Its range is 1 ~ 65535. In order to avoid confliction with general UDP port numbers, you are recommended to use the UDP port number above 1024.
hwUserlogFlowSlotRunInfoTable	1.3.6.1.4.1.2011.5.25.18.1.2.7		not-accessible	A table of BAS FLOW LOG running information for the specified slot.
hwUserlogFlowSlotRunInfoEntry	1.3.6.1.4.1.2011.5.25.18.1.2.7.1		not-accessible	Running Information Entry for a slot.
I32 hwUserlogFlowRunSlotNumber	1.3.6.1.4.1.2011.5.25.18.1.2.7.1.1	Integer32	read-only	Slot number. The object specifies on which slot the BAS FLOW LOG statistics are calculated.
C32 hwUserlogFlowTotalEntries	1.3.6.1.4.1.2011.5.25.18.1.2.7.1.2	Counter32	read-only	The total number of BAS FLOW Entries which are logged.
C32 hwUserlogFlowTotalPackets	1.3.6.1.4.1.2011.5.25.18.1.2.7.1.3	Counter32	read-only	The total number of FLOW LOG UDP packet generated by the device.
C32 hwUserlogFlowFailedEntries	1.3.6.1.4.1.2011.5.25.18.1.2.7.1.4	Counter32	read-only	The total number of BAS FLOW entries failed in outputting.
C32 hwUserlogFlowFailedPackets	1.3.6.1.4.1.2011.5.25.18.1.2.7.1.5	Counter32	read-only	The total number of BAS FLOW LOG UDP packet failed in outputting.
I32 hwUserlogFlowClearRunStat	1.3.6.1.4.1.2011.5.25.18.1.2.7.1.6	Integer32	read-write	Clears the running statistics for FLOW LOG. Its access is write-only. If 1, the running statistics for FLOW LOG is resetted. Other value is invalid.
hwUserlogAccessObjects	1.3.6.1.4.1.2011.5.25.18.1.3
I32 hwUserlogAccessVersion	1.3.6.1.4.1.2011.5.25.18.1.3.1	Integer32	read-only	BAS ACCESS LOG version. Currently only version 1 is developed.
I32 hwUserlogAccessSyslog	1.3.6.1.4.1.2011.5.25.18.1.3.2	Integer32	read-write	BAS ACCESS LOG format. If 1, LOG format is sysLog; If 0, LOG format is UDP packet. UDP packet is the default format, and is recommended. Syslog can be used in the case that log amount is not too large.
IP hwUserlogAccessSourceIP	1.3.6.1.4.1.2011.5.25.18.1.3.3	IpAddress	read-write	The Source IP address of BAS ACCESS LOG UDP packet. By default, the source IP address of the UDP packet is the IP address of the interface through which the router outputs the user log packet. On the user log server side, the source of log information can be located rapidly through identifying the source IP address of the log. You are recommended to configure a loopback address or router ID to function as the source IP address of the UDP packet.
hwUserlogAccessSlotCfgInfoTable	1.3.6.1.4.1.2011.5.25.18.1.3.4		not-accessible	A table of BAS ACCESS LOG configuration information for the specified slot.
hwUserlogAccessSlotCfgInfoEntry	1.3.6.1.4.1.2011.5.25.18.1.3.4.1		not-accessible	BAS ACCESS LOG configuration information entry for a slot.
I32 hwUserlogAccessCfgSlotNumber	1.3.6.1.4.1.2011.5.25.18.1.3.4.1.1	Integer32	read-only	Slot number. The object specifies which slot is configured with BAS ACCESS LOG.
I32 hwUserlogAccessEnable	1.3.6.1.4.1.2011.5.25.18.1.3.4.1.2	Integer32	read-write	The BAS ACCESS LOG feature status. If 1, BAS ACCESS LOG is enabled. If 0, BAS ACCESS LOG is disabled. The default value 0 means BAS ACCESS LOG is disabled.
IP hwUserlogAccessHostAddress	1.3.6.1.4.1.2011.5.25.18.1.3.4.1.3	IpAddress	read-write	The IP address of BAS ACCESS LOG server. If user log is output in UDP packet mode, user log server must be configured and user log server address must be specified correctly. Otherwise, user log function cannot work normally. The address of the destination server must be a valid unicast address rather than a loop address or multicast address. In principle, it should be the address of the user log server that can communicate normally.
I32 hwUserlogAccessUdpPort	1.3.6.1.4.1.2011.5.25.18.1.3.4.1.4	Integer32	read-write	The UDP Port Number of BAS ACCESS LOG server. Its range is 1 ~ 65535. In order to avoid confliction with general UDP port numbers, you are recommended to use the UDP port number above 1024.
hwUserlogAccessSlotRunInfoTable	1.3.6.1.4.1.2011.5.25.18.1.3.5		not-accessible	A table of BAS ACCESS LOG running information for the specified slot.
hwUserlogAccessSlotRunInfoEntry	1.3.6.1.4.1.2011.5.25.18.1.3.5.1		not-accessible	Running Information Entry for a slot.
I32 hwUserlogAccessRunSlotNumber	1.3.6.1.4.1.2011.5.25.18.1.3.5.1.1	Integer32	read-only	Slot number. The object specifies on which slot the BAS ACCESS LOG statistics are calculated.
C32 hwUserlogAccessTotalEntries	1.3.6.1.4.1.2011.5.25.18.1.3.5.1.2	Counter32	read-only	The total number of BAS ACCESS records which are logged.
C32 hwUserlogAccessTotalPackets	1.3.6.1.4.1.2011.5.25.18.1.3.5.1.3	Counter32	read-only	The total number of ACCESS LOG UDP packet generated by the router.
C32 hwUserlogAccessFailedEntries	1.3.6.1.4.1.2011.5.25.18.1.3.5.1.4	Counter32	read-only	The total number of BAS ACCESS entries failed in outputting.
C32 hwUserlogAccessFailedPackets	1.3.6.1.4.1.2011.5.25.18.1.3.5.1.5	Counter32	read-only	The total number of BAS ACCESS LOG UDP packet failed in outputting.
I32 hwUserlogAccessClearRunStat	1.3.6.1.4.1.2011.5.25.18.1.3.5.1.6	Integer32	read-write	Clear the running statistics for ACCESS LOG. Its access is write-only. If 1, the running statistics for ACCESS LOG is resetted, the other value is invalid.
hwUserlogNotifications	1.3.6.1.4.1.2011.5.25.18.2
hwUserlogConformance	1.3.6.1.4.1.2011.5.25.18.3
hwUserlogCompliances	1.3.6.1.4.1.2011.5.25.18.3.1
hwUserlogCompliance	1.3.6.1.4.1.2011.5.25.18.3.1.1			The compliance statement for entities which implement the Huawei Userlog mib.
hwUserlogGroups	1.3.6.1.4.1.2011.5.25.18.3.2
hwUserlogMandatoryGroup	1.3.6.1.4.1.2011.5.25.18.3.2.1			A collection of objects providing mandatory Userlog information.
hwUserlogConfigGroup	1.3.6.1.4.1.2011.5.25.18.3.2.2			All configurable parameters of Userlog feature.
hwUserlogInfoGroup	1.3.6.1.4.1.2011.5.25.18.3.2.3			All running information of Userlog feature.

RFC description

Huawei user log management for tracking NAT and broadband access server user flows and login/logout information.

Start monitoring Huawei BRAS/NAT gateway/broadband access device (subscriber NAT user log) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download HUAWEI-USERLOG-MIB