There was a 4 gigabyte /var/log/BRCM_PKT.log on an EX4100 running 23.4R2-S5.8. This was on the Backup RE (fpc1). Customer deleted the file because the disk was full but it has created a new one.
{master:0}
root@switch> request session member 1
Last login: Tue Jan 13 08:38:26 from master
--- JUNOS 23.4R2-S5.8 Kernel 64-bit JNPR-12.1-20250430.960aa75_buil
warning: This chassis is operating in a non-master role as part of a virtual-chassis (VC) system.
warning: Use of interactive commands should be limited to debugging and VC Port operations.
warning: Full CLI access is provided by the Virtual Chassis Master (VC-M) chassis.
warning: The VC-M can be identified through the show virtual-chassis status command executed at this console.
warning: Please logout and log into the VC-M to use CLI.
{backup:1}
root@switch> file list detail /var/log|match BRCM
-rw-r--r-- 1 root wheel 3547697 Jan 13 09:35 BRCM_PKT.log
The root cause is a problem in the code handling compression and rotation of the ukern_trace logs, and generating unwanted logging of BRCM_PKT traces.
This issue has been resolved in Junos OS 24.1 and later releases. The workaround is to disable both file-logging and logging for BRCM_PKT, then delete the BRCM_PKT.log in shell mode. Here are the steps:
------
labroot@jtac-ex4100-f-48p-r2019>request session member 1
labroot@jtac-ex4100-f-48p-r2019> start shell user root
Password:
root@jtac-ex4100-f-48p-r2019:RE:0% vty fpc0
TFXPC0(jtac-ex4100-f-48p-r2019 vty)# show ukern_trace file-logging
Ukernel Trace File-logging Info:
ID Name Level Logging BytesWrote Wrap BytesLost
---- ----------- ------- ------- ----------- ----- ----------
15 BRCM_PKT terse On 580 0 0 <<<<< check ID for BRCM_PKT
TFXPC0(jtac-ex4100-f-48p-r2019 vty)# set ukern_trace 15 file-logging disable
root@jtac-ex4100-f-48p-r2018:RE:0% cd /var/log/
root@jtac-ex4100-f-48p-r2018:RE:0% ls
BRCM_PKT.log authd_profilelib dfwd_japi jam_clksyncd jdhcpd_era_v4
root@jtac-ex4100-f-48p-r2018:RE:0% rm BRCM_PKT.log
UKERN_GBL.log authd_sdb.log dhcp_logfile jam_cosd jdhcpd_era_v4
If BRCM_PKT.log file is re-generated even after performing the above steps, please reboot the device once, then disable logging and delete the log file again.
According to the PR, the workaround is as follows:
In the vty mode on all vc members set ukern_trace <# of BRCM_PKT> file-logging disable set ukern_trace <# of BRCM_PKT> logging disable