Junos Space did not receive something (JMB/syslog) that a device was supposed to have sent.
In many scenarios, managed devices notify Junos Space of something (that a JMB is generated, asking Junos Space to collect or notify that a commit happened, asking Junos Space to auto-resync NSOR, and so on). This article describes an important daemon on the device that makes the transfer possible. It also describes how Junos Space spawns the daemon on the device.
Whenever a device is discovered in Junos Space, it adds the following config stanza on to the device.
set system syslog file messages any notice set system syslog file messages authorization info set system syslog file interactive-commands interactive-commands any set system syslog file default-log-messages any info set system syslog file default-log-messages match "(requested 'commit' operation)|(copying configuration to juniper.save)|(commit complete)|ifAdminStatus|(FRU power)|(FRU removal)|(FRU insertion)|(link UP)|transitioned|Transferred|transfer-file|(license add)|(license delete)|(package -X update)|(package -X delete)|(FRU Online)|(FRU Offline)|(plugged in)|(unplugged)|CFMD_CCM_DEFECT| LFMD_3AH | RPD_MPLS_PATH_BFD|(Master Unchanged, Members Changed)|(Master Changed, Members Changed)|(Master Detected, Members Changed)|(vc add)|(vc delete)|(Master detected)|(Master changed)|(Backup detected)|(Backup changed)|(interface vcp-)|(AIS_DATA_AVAILABLE)" set system syslog file default-log-messages structured-data
In addition to this, there is another important daemon that runs on managed Junos OS devices that actually makes the transfer possible. This daemon consistently monitors default-log-messages and sends syslog notifications to Junos Space if a certain condition (that is committed during discovery) is met. This binary on Junos OS is called syslog-filter and it runs on the managed device until the time Junos Space manages it. If you are troubleshooting certain issues on why Junos Space did not receive something that a device was supposed to send, use the following command to check whether this daemon is running on the device in the first place:
root@custmx% ps auxw | grep filter root 81693 0.0 0.1 6036 2660 ?? S 7:36AM 0:00.03 /usr/sbin/syslog-filter -X -f default-log-messages
How does Junos Space spawn this daemon? As part of device discovery, Junos Space calls the <get-syslog-events> RPC. This RPC is an asynchronous call that spawns the syslog-filter daemon on the device:
<rpc> <get-syslog-events> <stream> default-log-messages <rpc-reply xmlns="urn:ietf:params:xml:ns:netconf:base:1.0" xmlns:junos="http://xml.juniper.net/junos/11.4R6/junos"> <syslog-events>
/var/log/jboss/servers/server1/server.log