2040 CHAPTER 110: NETSTREAM CONFIGURATIONn XLog network log audit system (XLog) provides solutions for administrators toaudit users’ logs through networking with network devices such as routers andswitches. XLog supports logs such as NAT, FLOW, DIG and NetStreamv5.Introduction toNetStream AggregationNetStream provides the aggregation function, where aged stream statistics areclassified and aggregated according to certain rule. The aggregation information isthen transmitted.At present, five aggregation approaches as described in the following table areavailable.n According to the classification rule of the specified aggregation mode, the systemmerges multiple streams into one, which corresponds to one aggregation record.The five modes work independently but you may configure them at the sametime.Implementation ofNetStreamWith NetStream enabled, the device first stores statistics collected for each streamin a NetStream cache, and when they get aged, sends them in UDP packets toNSC and clear the statistics from the NetStream cache.NetStream uses two versions of UDP packets: version 5 and version 8. Generally,aged stream statistics are delivered in version 5 UDP packets.When you configure the attributes of version 5 UDP packets:■ If no NetStream aggregation is configured, the device sends the aged statisticsin version 5 UDP packets to the NSC.■ When NetStream aggregation is configured, stream statistics are classified andaggregated according to certain rule. The aggregate information is transmittedin version 8 UDP packets to the NSC.MPLS stream statistics are sent in version 9 UDP packets. When you configure theattributes of version 9 NetStream statistics packets, the device sends the statisticsin version 9 packets to NSC.Table 58 Five aggregation modes of NetStreamMode Classification ruleAutonomous system (AS)aggregationSource AS number, destination AS number, inboundinterface index, outbound interface indexProtocol-port aggregation Protocol number, source port, destination portSource-prefix aggregation Source AS number, source address mask length, sourceprefix, inbound interface indexDestination-prefix aggregation Destination AS number, destination address mask length,destination prefix, outbound interface indexSource and destination prefixaggregationSource AS number, destination AS number, source addressmask length, destination address mask length, sourceprefix, destination prefix, inbound interface index,outbound interface index
