Description

This article describes the behavior of the hostname shown in stream log when SRX forms chassis cluster.

Symptoms

Topology:

SRX cluster(192.168.1.1)—Switch—(192.168.1.3)Syslog Server
 
node0 hostname :SRX240-3
node1 hostname :SRX240-4
 

Security log configuration:

set security log mode stream
set security log format sd-syslog
set security log source-address 192.168.1.1
set security log stream test-log host 192.168.1.3

Security log is the log for traffic, so it should be generated from the primary node. However, the hostname will not be updated when failover occurs. 

{primary:node1}
root@SRX240-4> show chassis cluster status 
Cluster ID: 1
Node   Priority Status         Preempt Manual   Monitor-failures
 
Redundancy group: 0 , Failover count: 1
node0  100      secondary      no      no       None          
node1  1        primary        no      no       None          
 
Redundancy group: 1 , Failover count: 0
node0  100      primary        no      no       None           
node1  1        secondary      no      no       None

The traffic goes through node0 in RG1, which the log should be from SRX240-3.  However, the log hostname is showing 240-4 because when the security log setting was configured, node1 is the primary in RG0.


 

Failover to node0 in RG0 

{primary:node0}
root@SRX240-3> show chassis cluster status
Redundancy group: 0 , Failover count: 1
node0  255      primary        no      yes      None          
node1  1        secondary-hold no      yes      None          
 
Redundancy group: 1 , Failover count: 1
node0  100      primary        no      no       None          
node1  1        secondary      no      no       None
Now in all RG, node0 should be the primary. However, the log is still showing 240-4.

Solution

This behavior is by design. The PFE(s) get the hostname from the active RE only. When node0 fails, node1 becomes active. However, that does not result in a configuration push because both nodes share the same configuration and the PFE(s) already have the configuration. So new data plane logs will still use the old one as the hostname.

Recreate the security log configuration to refresh the host name.

Disable and enable the security log configuration and restart syslog server:

  • set security log disable
  • delete security log disable 

The syslog server will show 240-3 successfully.