Syslog output from SRX appears in different format for system logs and traffic logs. Are these both RFC compliant?

Syslog output format is different between system logs and traffic logs - in particular the datestamp fields.

Sample output (as seen from STRM server) as follows..

<10>Aug 27 06:59:53 SRX3600A SRX3600A: intranet-lsys: rpd[4307]: task_connect: task BGP_65100_65200.172.16.1.1+179 addr 172.16.10.1+179: Can't assign requested address

<23>1 2013-08-27T07:08:01.366 SRX3600A RT_FLOW - RT_FLOW_SESSION_CREATE_LS [[email protected] logical-system-name="test-lsys" source-address="10.10.10.100" source-port="4206" destination-address="10.20.20.15" destination-port="445" service-name="junos-smb" nat-source-address="10.10.10.100" nat-source-port="4206" nat-destination-address="10.20.20.15" nat-destination-port="445" src-nat-rule-name="None" dst-nat-rule-name="None" protocol-id="6" policy-name="123" source-zone-name="TEST1" destination-zone-name="TEST2" session-id-32="14285714" username="N/A" roles="N/A" packet-incoming-interface="reth1.100"]

These are both RFC compliant, but follow two different RFCs.

The first log message follows the older format from RFC 3164 (http://www.ietf.org/rfc/rfc3164.txt). This RFC defines the format as "Mmm dd hh:mm:ss", with whole seconds only.

The second is a newer format which follows RFC 3339 (http://www.ietf.org/rfc/rfc3339.txt) and appears a little more flexible, most notably provision for fractions of a second (better for traffic logs).

Traditional syslog follows the old format, whereas "sd_syslog" and "welf" follow the new format. It is by design that the different formats are used in JunOS.



On the SRX, "default-log" and "default-log-syslog" have different formats, as below..


{primary:node0}
root@cixi> show configuration system syslog
user * {
    any emergency;
}
file messages {
    any any;
    authorization info;
    structured-data;
}
file default-log {
    any any;
    match RT_FLOW_SESSION;
    structured-data;
}
file default-log-syslog {
    any any;
    match RT_FLOW_SESSION;
}



RFC 3164 compliant:

root@cixi> show log default-log-syslog
Nov 4 16:23:09 cixi RT_FLOW: RT_FLOW_SESSION_CREATE: session created 50.0.0.100/24065->30.0.0.100/768 icmp 50.0.0.100/24065->30.0.0.100/768 None None 1 alg-policy untrust trust 100000165 N/A(N/A) reth2.0 UNKNOWN UNKNOWN UNKNOWN

{primary:node0}
root@cixi> show log default-log
Nov 4 16:22:57 cixi clear-log[2864]: logfile cleared
<14>1 2013-11-04T16:23:09.264Z cixi RT_FLOW - RT_FLOW_SESSION_CREATE [[email protected] source-address="50.0.0.100" source-port="24065" destination-address="30.0.0.100" destination-port="768" service-name="icmp" nat-source-address="50.0.0.100" nat-source-port="24065" nat-destination-address="30.0.0.100" nat-destination-port="768" src-nat-rule-name="None" dst-nat-rule-name="None" protocol-id="1" policy-name="alg-policy" source-zone-name="untrust" destination-zone-name="trust" session-id-32="100000165" username="N/A" roles="N/A" packet-incoming-interface="reth2.0" application="UNKNOWN" nested-application="UNKNOWN" encrypted="UNKNOWN"] session created 50.0.0.100/24065->30.0.0.100/768 icmp 50.0.0.100/24065->30.0.0.100/768 None None 1 alg-policy untrust trust 100000165 N/A(N/A) reth2.0 UNKNOWN UNKNOWN UNKNOWN