262H3C recommends that you use a Loopback interface's address as the source IP address for flow logpackets. A Loopback interface is always up. The setting avoids export failure on interfaces that might godown.To configure the source IP address for flow log packets:Step Command Remarks1. Enter system view. system-view N/A2. Specify a source IP addressfor flow log packets.userlog flow export source-ipip-addressBy default, the source IP addressfor flow log packets is the IPaddress of their outgoing interface.Enabling load balancing for flow log entriesBy default, the device sends a copy of each flow log entry to all available log hosts. When one log hostfails, other log hosts still have complete flow log entries.In load balancing mode, flow log entries are distributed among log hosts based on the source IPaddresses (before NAT) that are recorded in the entries. The flow log entries generated for the samesource IP address are sent to the same log host. If a log host goes down, the flow logs sent to it will belost.To enable load balancing for flow log entries:Step Command Remarks1. Enter system view. system-view N/A2. Enable load balancing forflow log entries.userlog flow exportload-balancingBy default, load balancing isdisabled.Configuring the timestamp of flow logsThe device uses either the local time or the UTC time in the timestamp of flow logs.• UTC time—Standard Greenwich Mean Time (GMT).• Local time—Standard GMT plus or minus the time zone offset.The time zone offset can be configured by using the clock timezone command. For moreinformation, see Fundamentals Configuration Guide.By default, the UTC time is used.To configure the device to use the local time in the flow log timestamp:Step Command Remarks1. Enter system view. system-view N/A2. Configure the device to usethe local time in the flow logtimestamp.userlog flow export timestamplocaltimeBy default, the UTC time is used inthe flow log timestamp.
