Description

This article explains how to save the Traffic log under stream mode on the new SRX platform with Junos 15.1X49-D70 and above.

Important Note: This feature is supported on the following platforms and Junos versions:

Junos VersionPlatforms
15.1X49-D70 and later versionsvSRX 2.0, SRX 1500, SRX 4100, SRX 4200
17.4R2 and later versionsSRX4600
18.4R1 and later versionsvSRX3

 

Symptoms

Beginning with Junos 15.1X49-D70, you can save traffic log in device under stream mode. In this situation, you can save the traffic log file on SRX.

The following text is from Release 15.1X49-D70 Software Features :

On-box logging
Starting with Junos OS Release 15.1X49-D70,
SRX1500, SRX4100, and SRX4200 devices, and vSRX instances support all the current SRX Series logging functionality.
This release also introduces some modifications to the current logging functionality.

The major functionalities introduced are:
• On-box traffic logging to solid-state drives (SSDs) supports eight external log servers or files.
• An all-in-one XML file is added that contains all the traffic logs information.
The XML file also generates all the logging header files and traffic-log-related documents.

Solution

Here is the configuration. You do not need to configure the log under system syslog.

--------------
set security log mode stream
set security log stream stream1 file name traffic-log
set security log stream stream1 file size 10
--------------

The log file will be stored at /var/traffic-log/ directory. You can use the command below to check the log via the CLI.
 
[edit]
root>show security log stream file traffic-log
<14>Feb 17 02:29:39 RT_FLOW: RT_FLOW_SESSION_CREATE: session created 192.168.1.2/0->192.168.2.2/24279 0x0 icmp 192.168.1.2/0->192.168.2.2/24279 0x0 N/A N/A N/A N/A 1 policyA untrust trust 1 N/A(N/A) ge-0/0/0.0 UNKNOWN UNKNOWN UNKNOWN
<14>Feb 17 02:29:40 RT_FLOW: RT_FLOW_SESSION_CREATE: session created 192.168.1.2/1->192.168.2.2/24279 0x0 icmp 192.168.1.2/1->192.168.2.2/24279 0x0 N/A N/A N/A N/A 1 policyA untrust trust 2 N/A(N/A) ge-0/0/0.0 UNKNOWN UNKNOWN UNKNOWN

OR
 
root> show log /var/traffic-log/traffic-log
<14>Feb 17 02:29:39 RT_FLOW: RT_FLOW_SESSION_CREATE: session created 192.168.1.2/0->192.168.2.2/24279 0x0 icmp 192.168.1.2/0->192.168.2.2/24279 0x0 N/A N/A N/A N/A 1 policyA untrust trust 1 N/A(N/A) ge-0/0/0.0 UNKNOWN UNKNOWN UNKNOWN
<14>Feb 17 02:29:40 RT_FLOW:RT_FLOW_SESSION_CREATE: session created 192.168.1.2/1->192.168.2.2/24279 0x0 icmp 192.168.1.2/1->192.168.2.2/24279 0x0 N/A N/A N/A N/A 1 policyA untrust trust 2 N/A(N/A) ge-0/0/0.0 UNKNOWN UNKNOWN UNKNOWN

Modification History

2024-04-16: Removed "SRX340, SRX345 and SRX550M (when using SSD in rear SSD slot)" from the supported platforms as they do not support the on-box logging in the stream mode.
2019-08-20: Added affected Junos versions and platforms.

Related Information