This article illustrates the reason why the stream logs are not sent through the device when the log egress interface is in a Virtual Router.

When you enable stream mode on the device and the egress interface is in a VR, the logs are not sent through the device.

Example config:

security {
          log {
               mode stream;
               format sd-syslog;
               source-address 10.10.10.2; < --- The egress interface is part of VR and 10.10.10.2 is the IP of that interface
               stream securitylog {
                    category all;
                    host {
                         10.10.10.1;
                         port 514;
                         }
                    }
              }
         }


The point to be made here is that "stream mode source-address" is not tied to the egress interface. It is just an IP address that is used to show the source IP. The route lookup is done from inet.0. Thus you need to have at least one interface as part of the inet.0 and define the static/import route to the Syslog server with next-table VR.

In case of a standalone SRX, if you do not have any interface bound to inet.0, a loopback interface is defined with a dummy IP, and a static route is configured with the next-table VR.

If it is a Chassis Cluster, then the fxp0 interface is present and so all you need to define is the static route.

Example:    (verified with Junos 11.2R6) 

1. The interface 10.10.10.1 is routable via VR named trafficvr
2. Stream mode configuration is used as above.
3. A dummy IP is defined on the loopback interafce. Here we are using 192.168.1.1:
   root@srx1# show interfaces lo0
unit 0 {
      family inet {
         address 192.168.1.1/32 ;
                  }
       }

4. A static route is configured with next table Virtual Router trafficvr:
   root@srx1# show routing-options
static {
      route 10.10.10.1/32 next-table trafficvr.inet.0;
}