Description

How do you determine where logs are written to

Symptoms

  • In ScreenOS, logs triggered are written to alarm and event logs
  • In ScreenOS, policy logs can be obtained directly from the box
  • Traceoptions are enabled
  • Policy Logs are enabled
  • Where are logs written to?

Solution

In general, when you run a traceoption, you can specify the file where you want the traceoption output to be written to.

For example, the following configuration will send the output to a file called webnotime.txt, with a maximum file size of 1 MB.  Note that it is security flow traceoptions, with a flag of basic-datapath (which is similar to a debug flow basic in ScreenOS). 

[edit security flow]
lab@test# show 
inactive: traceoptions {
    file web-notime.txt size 1000k;
    flag basic-datapath;
    packet-filter trust-pc {
        source-prefix 192.168.10.60/32;
        destination-prefix 207.17.137.240/32;
    }
}
 
  UTM  
 When you apply a traceoption for any UTM feature, there is not an option to specify a file to write to.  By default, these will be written to a file based on the UTM module used.  The table below lists the file the output will be written to when enabled under that UTM module: 
 
 
  Feature    File Name  
 anti-virus  utmd-av 
 web-filtering  utmd-wf 
 anti-spam  utmd-as 
 application proxy  utmd-apppxy 
 
 
  IKE or IPsec  
 When you apply a traceoption for IKE or IPSec, the output for this is written to a file called  kmd  . 
 
  
 Policy and System Logs  
 Policy logs and any other system level events are written to the file specified in the system syslog configuration file.  By default, this file is called  messages  .  By default, the  messages  file will only log critical level messages.  In order to view messages lower than critical level, you need to configure the syslog server to accept messages of a lower severity level.  
 
 In the system syslog config, by default, it will have the following configuration: 
[edit system syslog]
lab@test# show 
user * {
    any emergency;
}
file messages {
    any critical;
    authorization info;
}
 Policy logs have the severity level of info.  You can create a separate file called  policy-logs  , and have info level messages sent to  policy-logs  . 
 
[edit system syslog]
lab@test# show 
...
file policy-logs {
    any info;
    authorization info;
}


  Interface  
 Refer to  KB16172 - What is the default output log file for 'interface' traceoptions  [juniper.net] .