Description

This article provides information on how to configure IDP logs on SRX series devices.

Solution

      1. To turn on logging, first turn on notification to log attacks:
# set security idp idp-policy recommended rulebase-ips rule 1 then notification log-attacks

   2. Enable security loggin:

*Using stream mode

root@srx# show security log
mode stream;
stream IDP_Log {
    format syslog;
    category idp;
    host {
        10.1.1.100;
    }
    source-address 192.168.0.1;
}

_________________________________________

 

*Using event mode

[edit]
root@srx# show security log
mode event;

[edit]
root@srx# show system syslog
file IDP_log {
    any any;
    match RT_IDP;
}


 
     3. If using event mode  now you can view the signatures that are triggered and attacks that are                               matched by typing the following command:
> show log IDP_Log


If using stream mode you can review the logs in the external collector.

 

If you are not receiving as many messages as required, disable log suppression:

Note: This is not recommended for a prolonged time, as it will cause a lot of logs to be created over a short time; depending on traffic and attacks.
# set security idp sensor-configuration log suppression disable

Modification History

10-21-2023:  Added more details and example to collect the logs either locally or in external collector.
 

Related Information

Details of security log modes (event, steam, stream-event).

https://www.juniper.net/documentation/us/en/software/junos/network-mgmt/topics/ref/statement/security-edit-mode-security-logging.html