Description

This article explains where to find policy logs when policy logging is enabled.

 

Symptoms

  • Log is enabled on a policy.

  • J-Web shows logging is enabled on policy.

  • I am unable to find policy logging.

 

Solution

Policy logs have the severity level of Info. So in order to get policy logs enabled, you need to have the system syslog enabled to log info level messages. You can also narrow this down, and filter messages based on the string "flow_session".

Example 

[edit system syslog]
root@test# show
user * {
    any emergency;
}
file messages {
    any critical;
    authorization info;
}
file policy-logs {
    any info;
    authorization info;
    match FLOW_SESSION
}

[edit system syslog]
root@test#
In this example, policy logs are stored in the file policy-logs, and it is set to match the keyword "FLOW_SESSION", and those messages are of severity Info. 
Dec 23 15:01:41  test RT_FLOW: RT_FLOW_SESSION_CLOSE: session closed TCP RST: 19
2.168.10.60/3933->172.24.60.143/80 junos-http 172.24.30.178/8280->172.24.60.143/
80 interface-nat None 6 http-out trust untrust 7188 8(2698) 5(525) 2

 

Modification History

2020-10-22: Article reviewed for accuracy; no changes made; article valid and relevant