This article describes the issue of J-Web unable to display "Events Details".

The J-Web events filter based on syslog file details can't display "Events Details" under Monitor > Events and Alarms > View events .

We can simulate the issue with the CLI, as shown below:

root@% junoscript interactive

<junoscript xmlns="http://xml.juniper.net/xnm/1.1/xnm" xmlns:junos="http://xml.juniper.net/junos/12.1I0/junos" schemaLocation="http://xml.juniper.net/junos/12.1I0/junos junos/12.1I0/junos.xsd<http://xml.juniper.net/junos/12.1I0/junos%20junos/12.1I0/junos.xsd>



<junoscript xmlns="http://xml.juniper.net/xnm/1.1/xnm" xmlns:junos="http://xml.juniper.net/junos/12.1I0/junos" schemaLocation="http://xml.juniper.net/junos/12.1I0/junos junos/12.1I0/junos.xsd<http://xml.juniper.net/junos/12.1I0/junos%20junos/12.1I0/junos.xsd>



<rpc> <get-event-summary> <syslogfile> messages <start-time> 04/23/2015 13:36 <total-message-display> 100 <show-start-event> 1 <show-end-event> 100 <new-search/> <end-time> 04/23/2015 13:40

<rpc-reply xmlns:junos="http://xml.juniper.net/junos/12.1I0/junos">

<xnm:error xmlns="http://xml.juniper.net/xnm/1.1/xnm" xmlns:xnm="http://xml.juniper.net/xnm/1.1/xnm">

<message>

No events match filter condition       <<<<  You can see the message when the issue happened. 



xnm:error >     <<<<  RPC failure error.



According to the above, the events filter based on the syslog file details displays no events even though there are events for the specified duration in the syslog file, as shown in the following CLI:

root# run show log messages | display xml
<rpc-reply xmlns:junos="http://xml.juniper.net/junos/12.1I0/junos">
<file-content filename="messages" junos:seconds="1429853725" filesize="396507" encoding="text">
Apr 23 13:15:00 newsyslog[14046]: logfile turned over due to size>1024K
Apr 23 13:16:45 file[14039]: UI_JUNOSCRIPT_ERROR: JUNOScript error: unknown command
Apr 23 13:16:45 file[14039]: UI_LOGOUT_EVENT: User 'root' logout
Apr 23 13:20:00 cron[14053]: (root) CMD ( /usr/libexec/atrun)
Apr 23 13:25:00 cron[14056]: (root) CMD ( /usr/libexec/atrun)
Apr 23 13:30:00 cron[14060]: (root) CMD (newsyslog)
Apr 23 13:30:00 cron[14061]: (root) CMD ( /usr/libexec/atrun)
--snip--

Apr 23 13:37:17 file[14067]: UI_JUNOSCRIPT_CMD: User 'root' used JUNOScript client to run command 'get-event-summary syslogfile=messages start-time=04/16/2015 19:48 end-time=04/16/2015 19:50 total-message-display=100 show-start-event=1 show-end-event=100 new-search'
Apr 23 13:37:39 file[14067]: UI_JUNOSCRIPT_ERROR: JUNOScript error: unknown command
Apr 23 13:37:39 file[14067]: UI_LOGOUT_EVENT: User 'root' logout

The reason for the RPC failure appears to be due to the absence of the hostname in the syslog messages.

We see the following syslog messages in /var/log/messages :

Apr 23 13:16:45 file[14039]: UI_JUNOSCRIPT_ERROR: JUNOScript error: unknown command
Apr 23 13:16:45 file[14039]: UI_LOGOUT_EVENT: User 'root' logout
Apr 23 13:20:00 cron[14053]: (root) CMD ( /usr/libexec/atrun)
Apr 23 13:25:00 cron[14056]: (root) CMD ( /usr/libexec/atrun)
Apr 23 13:30:00 cron[14060]: (root) CMD (newsyslog)

As you can see, there is no hostname present after the timestamp.

The implementation of the get-event-summary RPC mandates the hostname and expects syslog messages to be in the following format:

Because the hostname is absent, all the syslog messages are treated as invalid and the error No events match filter condition is returned.

Set the hostname as shown below:

2019-07-01: EX series added.  Content reviewed for accuracy.