This article provides instructions for the following:
Configuring an SRX firewall for sending control-plane or data-plane logs to an external syslog server such as Juniper Secure Analytics (JSA) or Junos Space. This configuration can also be used for sending logs to third party syslog servers
Displaying logs on JSA and Junos Space
Troubleshooting by confirming whether the SRX device is sending logs to the external server via a firewall filter that is applied on the external interface
For more SRX logging related information, refer to the following:
Configuring System Logging for a Security Device
SRX Getting Started - Configure Logging
SRX firewalls can send two types of logs to external syslog servers, such as JSA and Junos Space:
Control-plane logs , also called system logs or Routing Engine logs
Data-plane logs , also called traffic logs or security logs or PFE logs
Sending Control-plane logs
Control-plane logs are generated at the Routing Engine (RE) level and can be stored locally or sent to an external syslog server. In the following configuration example, all generated logs (any facility/severity ) are sent to an external server in a structured-data format; the server has an IP address of 192.0.2.5. For information about storing logs locally, refer to Sending System Log Messages to a File .
Commands related to control-plane logs are configured under the [edit system syslog] configuration stanza:
[edit system syslog]
set system syslog host 192.0.2.5 any any set system syslog host 192.0.2.5 structured-data set system syslog host 192.0.2.5 port 514
Note : The structured-data option works for most syslog servers but is a must for sending logs to Junos Space. Specifying other configuration options , such as the source-address, layer 4 port, or routing-instance, is also possible.
structured-data
Displaying Control-Plane Logs
Junos Space (outputs taken from version 21.2R1)
Access Security Director .
Click the Monitor tab.
Click Events & Logs and then All Events .
JSA (outputs taken from version 7.4.2 FixPack 3)
On the Log Activity tab, for Viewing real time events , select Real Time (streaming) .
Sending Data-Plane Logs
Data-plane logs are generated at the Packet Forwarding Engine (PFE) level and can be processed in the following two modes:
Stream mode : Logs are sent from the PFE to an external syslog server via a revenue port ( other than fxp0 interface ). High-end SRX devices are configured for this mode by default.
Event mode : Logs are sent from the PFE to the Routing Engine (RE) for local storage. Branch SRX devices are configured for this mode by default; however, it is important to note that there could be a negative impact on the Routing Engine during high-rate log generation scenarios. Due to this, use of Stream mode is generally suggested.
For further information about these modes, refer to the following Understanding Binary Format for Security Logs .
Commands related to data-plane logs are configured under the [edit security log] configuration stanza. In the following configuration example, all generated logs (any category ) are sent to an external server with a structured-data format and the server has an IP address of 192.0.2.5.
[edit security log]
set security log stream External_Server format sd-syslog set security log stream External_Server category all set security log stream External_Server host 192.0.2.5 set security log stream External_Server host port 514
Note : The sd-syslog option works for most syslog servers but is a must for sending logs to Junos Space. Specifying other configuration options such as the source-address, source-interface, layer 4 port, or routing-instance is also possible.
sd-syslog
Displaying Data-Plane Logs
Access Events & Logs and then Firewall .
On the Log Activity tab, for Viewing real time events , select Real Time (streaming) . A Quick Filter can be used for matching logs containing the " RT " statement.
RT
Troubleshooting
If it is suspected that the SRX device is not sending logs to the external server, the following steps can be performed to confirm whether the syslog messages are exiting the device. In the following configuration example, the external syslog server has an IP address of 192.0.2.5 and the SRX device's interface used for reaching this server is ge-0/0/0. The filter can, however, be applied on other types of interfaces such as fxp0, st0, reth, and xe.
Create a firewall filter to log and accept any packets that match the server's IP address as the destination-address.
set firewall filter SYSLOG_FILTER term SYSLOG_PACKETS from destination-address 192.0.2.5/32 set firewall filter SYSLOG_FILTER term SYSLOG_PACKETS from destination-port 514 set firewall filter SYSLOG_FILTER term SYSLOG_PACKETS then log set firewall filter SYSLOG_FILTER term SYSLOG_PACKETS then accept set firewall filter SYSLOG_FILTER term ALLOW_ELSE then accept
Apply this filter in the output direction on the interface that is facing the external server.
set interfaces ge-0/0/0 unit 0 family inet filter output SYSLOG_FILTER set interfaces ge-0/0/0 unit 0 family inet address 192.0.2.254/24
Commit the configuration and confirm that the SRX device is logging any entries for the matched syslog packets.
user@srx> show firewall log detail Time of Log: 2021-12-27 22:50:39 UTC, Filter: pfe, Filter action: accept, Name of interface: local Name of protocol: UDP, Packet Length: 185, Source address: 192.0.2.254:514, Destination address: 192.0.2.5:514 Time of Log: 2021-12-27 22:50:39 UTC, Filter: SYSLOG_FILTER, Filter action: accept, Name of interface: local Name of protocol: UDP, Packet Length: 185, Source address: 192.0.2.254:514, Destination address: 192.0.2.5:514 Time of Log: 2021-12-27 22:50:39 UTC, Filter: pfe, Filter action: accept, Name of interface: local Name of protocol: UDP, Packet Length: 237, Source address: 192.0.2.254:514, Destination address: 192.0.2.5:5144 Time of Log: 2021-12-27 22:50:39 UTC, Filter: SYSLOG_FILTER, Filter action: accept, Name of interface: local
2020-03-16: Changed STRM to include JSA/STRM and corrected an incorrect CLI.
2022-01-20: The entire article was modified to include information about control-plane, data-plane, and troubleshooting. STRM data and video were removed because they are EoS.