Description

This article explains how to add CustomLog which includes the source IP address and time information after accessing your SRX device via J-Web.

Symptoms

How to add CustomLog which includes the source IP address and time information after accessing your SRX device via J-web.

Solution

CAUTION: Perform the following edits with caution. Any mistakes may cause J-Web or any related HTTP server services to fail to start.

Enter into shell mode with root account:

> start shell user root
% cd /cf/var/jail/etc
% vi httpd.conf

Then add the changes and save them:


ErrorLog /var/log/httpd.log
LogLevel 2
CustomLog /var/log/access.log "%h %l %u %t \"%r\" %>s %b" <<<---here
DirectoryIndex index.php
...
:wq

root@SRX> show system processes extensive | match http
59242 nobody 2 88 0 9692K 4200K ucondt 0 0:02 0.00% httpd <<<----here
59077 root 1 76 0 13532K 6264K select 0 0:01 0.00% httpd-gk

%kill -9 59242

NOTE: Running the CLI command, ‘restart web-management’ will not work in this case because it restarts the httpd-gkprocess as well, which will cause the httpd.conf to be regenerated and void all previous changes. This change will not survive reboots.

Verification

Access your SRX via J-Web, then issue the command, ‘show log access.log’

10.141.25.29 - - [Wed Jun 22 08:54:23 2016 UTC] "POST /logout.php HTTP/1.1" 200 448
10.141.25.29 - - [Wed Jun 22 08:54:28 2016 UTC] "GET /index.php HTTP/1.1" 200 7274
10.141.25.29 - - [Wed Jun 22 08:54:49 2016 UTC] "POST /login.php HTTP/1.1" 200 7313
10.141.25.29 - - [Wed Jun 22 08:55:20 2016 UTC] "POST /login.php HTTP/1.1" 200 84145
10.141.25.29 - - [Wed Jun 22 08:55:21 2016 UTC] "POST /call.php HTTP/1.1" 200 446