This article explains how to resolve the problem security log streams not working through fxp0 interface after junos upgrade.
When device is configured in stream mode, logs are sent from the PFE to an external syslog server through a revenue port other than fxp0 interface. Refer to https://www.juniper.net/documentation/us/en/software/junos/cli-reference/topics/ref/statement/security-edit-mode-security-logging.html for more details But "sending stream logs from PFE out via fxp0 port" is not supported , However if one configured , it would actually work in old junos versions on some platforms (SRX-TVP platforms i,e SRX1500, SRX4200 etc). This is fixed in starting from below mentioned junos versions. junos:21.4R3-S10 junos:22.2R3-S6 junos:22.4R3-S5 junos:23.2R2-S2 junos:23.4R2-S1 junos:24.2R1 junos:24.2R2 junos:24.3R1 junos:24.4R1 So post upgrading to above mentioned or higher junos version, configuration need to be updated such a way that security logs need to be sent to external log server via revenue interface. Here is an example where post upgrade logs will be sent over revenue interface via reth0. root@SRX1500-1> show configuration | display set |match "security log" set security log mode stream set security log format sd-syslog set security log source-address x.x.x. set security log stream Splunk severity info set security log stream Splunk host y.y.y.y set security log stream Splunk host port 10914 set security log stream Splunk host routing-instance VR-LOG << root@SRX1500-1> show route y.y.y.y inet.0: 3 destinations, 3 routes (3 active, 0 holddown, 0 hidden) + = Active Route, - = Last Active, * = Both 0.0.0.0/0 *[Static/5] 00:13:08 > to a.a.a.a via fxp0.0 VR-LOG.inet.0: 35 destinations, 35 routes (35 active, 0 holddown, 0 hidden) + = Active Route, - = Last Active, * = Both 0.0.0.0/0 *[Static/5] 00:13:08 > to b.b.b.b via reth0.0
2025-07-28 : Article Created
202-01-12 : removed customer information, published to external