This article details how to gather logs or files from most Juniper Networks EX Series and QFX Series devices, which may play a vital role in Root Cause Analysis (RCA).
Note that collection of logs differs across Juniper Networks EX Series and QFX Series platforms. Follow the steps that are relevant for your device:
Collecting Logs from a Standalone Switch
Collecting Logs from Virtual Chassis/Virtual Chassis Fabric
Collecting Host Logs (QFXs / EX4600)
Collecting Logs from the EX8200/EX9200 line with Multiple Routing Engines
Exporting/Extracting the Archived Logs Saved in /var/tmp
/var/tmp
Option 1:
Enter the following command to archive the /var/log directory. The following command will zip (tar) the folder /var/log and name the file ( LOGS.tgz ). It will also push the zipped file to the destination folder /var/tmp .
/var/log
LOGS.tgz
root@Switch> file archive source /var/log destination /var/tmp/LOGS.tgz root@Switch> file list /var/tmp /var/tmp: .snap/ LOCK_FILE* LOGS.tgz <--File Created
Perform the steps in the section Exporting/Extracting the Archived Logs Saved in /var/tmp in order to copy the archived logs to your PC or another source.
Option 2:
If there are any permission issues, perform the following steps in shell mode to collect the files by using the tar command with root credentials:
tar
user@Switch> start shell user root root@Switch% tar -zcvf /var/tmp/varlog.tar.gz /var/log/* root@virtual-chassis% ls /var/tmp | grep varlog varlog.tar.gz <--File Created
Perform the steps in the section Exporting/Extracting the Archived Logs Saved in /var/tmp to copy the archived logs to your PC or another source.
Note: Collection of logs should be initiated from the primary device.
Log in to the primary device. Here we assume that FPC 0 is the primary device.
Enter the following command to archive the /var/log directory of the primary device. The following command will zip (tar) the folder /var/log and name the file ( MASTER-LOG.tar ). It will also push the zipped file to the primary switch.
MASTER-LOG.tar
{master:0} root@virtual-chassis> file archive source /var/log destination /var/tmp/MASTER-LOG
Log in to the other Virtual Chassis members (backup Routing Engine or Linecards). The steps will push a zipped file from the specified member ID to the primary switch (FPC 0). The destination folder remains /var/tmp :
{master:0} root@virtual-chassis> request session member 1 (For FPC 1 it will be 1, and so on) root@virtual-chassis:LC:1% cli {backup:1} root@virtual-chassis> file archive source /var/log destination fpc0:/var/tmp/BACKUP-LOG (This example copies files from FPC 1 to primary FPC 0; modify as needed) root@virtual-chassis> exit <--Log out from CLI mode of FPC1. root@virtual-chassis:LC:1% exit <--Log out from shell mode to return to the primary session.
Note: JTAC typically requires the logs from the primary RE and the backup RE. If needed, repeat these steps for Linecards as well by using the corresponding member ID.
Log back in to the primary device. Check whether all required files are stored under the /var/tmp directory:
root@virtual-chassis> file list /var/tmp | match log BACKUP-LOG.tar MASTER-LOG.tar
root@virtual-chassis> file list /var/tmp | match log
BACKUP-LOG.tar MASTER-LOG.tar
If there are any permission issues, perform the following steps to collect the files in shell mode, starting with the primary Routing Engine, by using the tar command with root credentials.
user@virtual-chassis> start shell user root root@virtual-chassis% tar -zcvf /var/tmp/varlog-mem0.tar.gz /var/log/*
Log in to the other VC members (backup RE or linecards). The steps will create a zipped file locally on this member ID with the destination folder /var/tmp :
root@virtual-chassis> request session member 1 (For FPC 1 it will be 1, and so on) root@virtual-chassis:LC:1% tar -zcvf /var/tmp/varlog-mem1.tar.gz /var/log/*
Go to the Command Line Interface (CLI) to copy the files from this Virtual Chassis member to the primary Routing Engine:
root@virtual-chassis:LC:1% cli {backup:1} root@virtual-chassis> file copy fpc1:/var/tmp/varlog-mem1.tar.gz fpc0:/var/tmp/ root@virtual-chassis> exit <--Log out from CLI mode of FPC1. root@virtual-chassis:LC:1% exit <--Log out from shell mode to return to the primary session.
Note: JTAC typically requires the logs from the primary RE and the backup RE. If needed, repeat steps 3 and 4 for linecards as well by using the corresponding member ID.
Log back in to the primary Routing Engine. Check whether all required files are stored in the /var/tmp directory:
root@virtual-chassis> file list /var/tmp | match log varlog-mem0.tar.gz varlog-mem1.tar.gz
Option 3:
How to collect Logs from other member VC without login to other members, only from master switch:
Collect logs from other members and added transfer it to Master member 0:
Note: Master is member 0 (FPC0), and collection of logs should be initiated from the primary device.
For example,
collect logs from member 1 >request routing-engine execute member 1 command "tar -zcvf /var/log/logs-member1 /var/log/*" | no-more
Transfer from fpc1 to master member 0 (fpc0) >file copy fpc1:/var/tmp/logs-member1 fpc0:/var/tmp/
Collect logs from member 2 request routing-engine execute member 2 command "tar -zcvf /var/log/logs-member2 /var/log/*" | no-more
Transfer from fpc2 to master member 0 (fpc0) file copy fpc2:/var/tmp/logs-member2 fpc0:/var/tmp/
**For other members follow the same procedure and change the name accordingly
Sometimes JTAC requires to check host log files on certain platforms. If requested, perform the following steps:
Go to host shell mode and use the tar command to compress the log files:
root@qfx5100> request app-engine host-shell <-- This command is hidden in some platforms; manually enter it on the CLI. root@qfx5100:~# tar -cvf /var/log/fpc0_host-logs.tar /var/log
Verify that the file was created by using ls -al /var/log :
ls -al /var/log
root@qfx5100:~# ls -al /var/log | grep host -rw-r--r-- 1 root root 13547520 Aug 14 13:43 fpc0_host-logs.tar <-- File Created root@qfx5100:~# exit <-- Exit Host mode.
ls -al /var/log | grep host -rw-r--r-- 1 root root 13547520 Aug 14 13:43 fpc0_host-logs.tar
exit
Copy the file from the host to the Junos VM:
root@qfx5100> request app-engine file-copy from-jhost fpc0_host-logs.tar to-vjunos /var/tmp log root@qfx5100> file list /var/tmp/| match host fpc0_host-logs.tar <-- File copied
Note: If JTAC instructs to collect host log files for the backup REs or the linecards on the Virtual Chassis or VCF designs, continue with these steps; otherwise, go to the Exporting/Extracting the Archived Logs Saved in /var/tmp section.
Go to the host shell mode on a particular VC/VCF member:
root@qfx5100> request session member 1 (For FPC1 it will be 1, and so on) root@qfx5100:BK:1% cli {backup:1} root@qfx5100> request app-engine host-shell
Using the tar command, compress the host logs files:
root@qfx5100:~# tar -czvf /var/tmp/fpc1.host.tgz /var/log <--Using FPC1 as example root@qfx5100:~# ls -al /var/log | grep host -rw-r--r-- 1 root root 14305280 Aug 14 13:34 fpc1_host-logs.tar <-- File Created root@qfx5100:~# exit <--Exit host shell mode.
Copy the files from the host shell to var/tmp on this member:
var/tmp
{backup:1} root@qfx5100> request app-engine file-copy from-jhost fpc1_host-logs.tar to-vjunos /var/tmp log root@qfx5100> file list /var/tmp/ | match host fpc1_host-logs.tar <-- File Copied
Copy the file from this member to the primary RE; in this case FPC 0 is our primary RE:
root@qfx5100> file copy fpc1:/var/tmp/fpc1_host-logs.tar fpc0:/var/tmp root@qfx5100> exit <--Log out from CLI mode of FPC1. root@qfx5100:LC:1% exit <--Log out from shell mode to return to the primary session. root@qfx5100> file list /var/tmp/ | match host fpc0_host-logs.tar fpc1_host-logs.tar <--File copied to the primary
Note: Repeat steps 4 to 7 for each required member.
Files in some EVO platforms may include excessive logs due to multiple traces which creates huge compress files or fail due to " file changed as we read it" error. Due to this, please use the following command instead:
root@jtac-qfx5130> file archive exclude *traces* source /var/log destination /var/tmp/logs /bin/tar: Removing leading `/' from member names root@jtac-qfx5130> file list /var/tmp /var/tmp: logs.tar <------
Note: Collection of logs should be Initiated from the primary device.
Log in to the primary Routing Engine. Here we assume that RE0 is the primary device.
root@EX9200> request routing-engine login master
Enter the following command to archive the /var/log directory of RE0. The following command will zip (tar) the folder /var/log and name the file ( RE0-LOG.tar ). It will also push the zipped file to the primary Routing Engine. The destination folder remains /var/tmp .
RE0-LOG.tar
{master:0} root@EX9200> file archive source /var/log destination re0:/var/tmp/RE0-LOG
Log in to the backup Routing Engine. Here we assume that RE1 is the backup device.
{master:0} root@EX9200> request routing-engine login backup root@EX9200% cli {backup:1}
Enter the following command to archive the /var/log directory of RE1. The following command will zip (tar) the folder /var/log and name the file ( RE1-LOG.tar ). It will also push the zipped file to the primary Routing Engine. The destination folder remains /var/tmp .
RE1-LOG.tar
{backup:1} root@EX9200> file archive source /var/log destination re0:/var/tmp/RE1-LOG
IMPORTANT: The archive includes several files. Therefore, specify the actual date/time of the outage to be analyzed when giving the archived logs to your technical support representative. This will help speed up the analysis.
Archived logs can be copied (exported) to your PC or another source by using either of the following methods:
Option 1: FTP
Download the saved logs on the device that is running Junos OS or switch through FTP services by performing the following:
Prerequisite: FTP services must be enabled on the device or switch. These services are not enabled by default.
root@Switch# set system services ftp root@Switch# commit
From the FTP client, log in to the switch (user: root ).
root
Change directory from /root to /var/tmp .
/root
Select the saved file. ( Note: As per the above example, the filename could be either LOGS or MASTER-LOG .)
LOGS
MASTER-LOG
Copy the saved file to the desired location by clicking Transfer .
saved
Option 2: SCP
Prerequisite: SSH needs to be allowed by using set system services ssh .
set system services ssh
Transfer the file by using SCP in shell mode with scp /path/to/file username@a:/path/to/destination .
scp /path/to/file username@a:/path/to/destination
Example
root@Switch> start shell user root root@Switch:0% scp /var/tmp/fpc0_host-logs.tar [email protected]:/var/tmp The authenticity of host '10.10.10.2 (10.10.10.2)' can't be established. ECDSA key fingerprint is SHA256:KrSwrb/wxY8K8Y6iAmdl37n+klcbbv6aadagagabcdef. Are you sure you want to continue connecting (yes/no)? yes Warning: Permanently added '10.10.10.2' (ECDSA) to the list of known hosts. Password: fpc0_host-logs.tar 100% 13MB 29.6MB/s 00:00 root@virtual-chassis:RE:0%
Additionally, you may SCP into the switch with port 22 by using an SCP client such as FileZilla or WinSCP.
Option 3: J-Web
Click Maintain > Files .
Click Temporary Files in the /var/tmp directory.
Select the check box next to the archived file collected above, and then click the Download link.
2022-03-11: Minor changes for JWEB, device naming and Juniper naming TM guide
2021-04-08: Updated the article terminology to align with Juniper's Inclusion & Diversity initiative
2021-10-06: Updated article and incorporated related information from various articles into this one