How to use the syslog and log action in a firewall filter configuration?

When a firewall filters is configured and the goal is to log packets which match a defined terms, there are 2 actions available in JUNOS software. The first is syslog action and the other is log action. How to use these 2 actions depends on where the logs are to be stored and how they are to be accessed. Note that whatever syslog action or log action, only a summary of packet will be logged, instead of a whole packet. Below is a sample syslog message.

Jul 16 11:12:46.698  ipswich-re0 cfeb PFE_FW_SYSLOG_IP: FW: fe-1/3/2.202 A ospf 10.13.75.5 224.0.0.5     0     0 (1 packets)

syslog action

A syslog action in a firewall filter will log all packets matching defined terms to PFE (Packet Forwarding Engine) RAM, and also PFE will send a copy to RE for further processing. These processing may include log these packets to Hard Disk or send to a remote syslog server. For example, if you configure syslog action in a firewall filter, you can choose to store the logs to a local hard disk file, or remote syslog server.

lab@m320-re0# show system syslog
host 172.27.1.1 {   
    firewall any;
}
<...>
file firewall {
    firewall any;
}

This config will store all firewall logged packet to either the syslog server at address 172.27.1.1 or a local file named "firewall" on the hard disk.

With this configuration, it is possible to check the firewall logs using show log firewall command on the Routing Engine, or connecting into the corresponding PFE and issuing "show syslog message" command.

Note: Be careful as using syslog action can cause too much logging into hard disk or PFE, which may cause abnormal system behavior. So in case of massive firewall logging, the remote syslog server is always recommended.

log action

Unlike syslog action, the log action will only store the firewall logged packets into PFE RAM, but PFE won't send a copy to RE for further process. So if the log action is configured, there is no way to store the firewall logged packets to a local file on the hard disk or send to a remote syslog server. Also, the PFE RAM size is limited, earlier firewall logs can be overridden if the new ones continue to come.
To check the firewall logs, use show firewall log command on the Routing Engine.

Notes:

Both the syslog and log actions can consume significant CPU and/or disk space on the device. Juniper recommends that you off-load logs by writing them to a remote syslog server, and that you constrain logging by using it for diagnostics only.

01/30/2025 - Added SRX devices to categories