Description

Unable to send logs to NSM from SRX Chassis Cluster when logging configured in stream mode.

Symptoms

The SRX3600 Chassis Cluster is added to NSM via fxp0 . The device is required to send logs to NSM  in stream mode .

The NSM is only able to see the system logs & not the traffic logs.

NSM can only receive the stream mode logs when modified as follows (valid for 2011.1 onwards):

To configure the DMI device to send the logs to NSM using stream mode, edit the /var/netscreen/DevSvr/devSvr.cfg file and set the devSvr.enableSyslogOverUdp parameter to true:
devSvr.enableSyslogOverUdp true

Complete steps can be seen at page 767 of the following article:
http://www.juniper.net/techpubs/software/management/security-manager/nsm2011_1/nsm-admin-guide.pdf
The route visible for NSM on the SRX cluster is via fxp0.
>show route 1.1.1.1
1.1.1.0/24      *[Direct/0] 1d 13:46:06
                        >fxp0.0
The stream mode stands for sending of logs from the data plane to the remote host without reaching the Routing Engine.
On the other hand, fxp0 is a non-routable interface which enables remote user to reach the Routing Engine.

So when we try to send the stream mode logs via fxp0, it fails .

Solution

The requirement can only be achieved if the device is reachable to NSM via a revenue port [not fxp0].

Additionally you need to send logs to NSM on port 5140. The partial configuration is shown as follows:

[edit]
root#show security log
mode stream;
source-address 2.2.2.2;
stream NSM {
     host {
         1.1.1.1;
         port 5140;
     }
}
In the above configuration, the NSM IP is considered to 1.1.1.1, and the SRX IP is 2.2.2.2 .

If you need to get the logs via fxp0, then you need to configure the device in event mode as shown in the following article: KB16643 [juniper.net]

Related Information