H3C Technologies H3C Intelligent Management Center - Manual (Page 343)

333
8. Click Deploy to accept and deploy the NTA server configuration changes.
After you have selected a device or probe in NTA, you must create a traffic analysis task if the data
source you want to use is an interface, probe, or VPN.
• For information on creating an interface traffic analysis task, see " Managing interface traffic
analysis Tasks ," specifically " Adding an interface traffic analysis task ."
• For information on creating a probe traffic analysis task, see " Managing probe traffic analysis
tasks ," specifically " Adding a probe traffic analysis task ."
• For information on adding a VPN task to NTA, see " Managing VPN traffic analysis tasks ,"
specifically " Adding a VPN traffic analysis task ."
Configuring the aggregation policy
NTA enables you to define the granularity that is used to process the network flow records. The standard
aggregation policy summarizes data at 5-minute intervals; the rough aggregation policy summarizes
data at 20-minute intervals.
1. Select Service > Traffic Analysis and Audit > Settings.
2. Click the Server Management link in the Settings area of the Traffic Analysis and Audit page.
NTA displays all servers in the Server List in the main pane of the Server Management page.
3. Click the Modify icon for the NTA server you want to modify.
4. From the Traffic Analysis Log Aggregation Policy list, select the aggregation policy you want to
apply to all log files processed by this NTA server. Options are:
• No Aggregation (Best Report Timeliness)—This option does not aggregate data and is
suitable for environments that have high requirements on report timeliness. This aggregation
mode requires much disk space because several logs will be generated.
• Aggregation (Standard)—This option aggregates data at 5-minute intervals and is suitable
for environments that have an average number of logs generated. It requires less disk space
than No Aggregation mode and more disk space than Aggregation (Rough Granularity)
mode.
• Aggregation (Rough Granularity)—This option aggregates data at 20-minute intervals and is
suitable for environments that have a small number of logs generated. It requires the least
amount of disk space.
5. Click Deploy to accept and deploy the NTA server configuration changes.
Creating an interface, probe, or VPN traffic analysis task
A traffic analysis task ties network flow records to data analysis and reporting. NTA will not capture log
data for a traffic log audit if the data source has not been added to a traffic analysis task. Administrators
must create traffic analysis tasks that define which data sources configured in NTA will become available
for traffic log auditing. The following information explains how to create traffic analysis tasks so that
interfaces, probes, and VPNs are available for traffic log audits.
Adding an interface traffic analysis task
Adding an interface traffic analysis task makes the device and its interfaces available as a data source
configuration option for a traffic log audit. For more information on adding an interface task to NTA, see
" Managing interface traffic analysis Tasks ," specifically " Adding an interface traffic analysis task ."