Description

This article explains why users may be unable to compress logs in stream mode by using the "last message repeated * times" message on SRX devices, and clarifies that this is behavior by design.

 

Symptoms

When using event mode, the log is seen to be compressed automatically as below: 

root@SRX-1400# run show log screening_log |no-more
Dec 26 14:14:16  SRX-1400 RT_IDS: RT_SCREEN_SESSION_LIMIT: Src IP session limit! source: 0.0.0.0:68, destination: 255.255.255.255:67, protocol-id: 17, zone name: untrust, interface name: ge-0/0/3.0, action: drop
Dec 26 14:14:24  SRX-1400 RT_IDS: RT_SCREEN_SESSION_LIMIT: Src IP session limit! source: 0.0.0.0:68, destination: 255.255.255.255:67, protocol-id: 17, zone name: untrust, interface name: ge-0/0/3.0, action: drop
Dec 26 14:15:16  SRX-1400 last message repeated 6 times

However, when using stream mode in the syslog server, the logs show one by one without "last message repeated * times." 

Dec 26 14:04:26 1.1.1.1 Dec 26 22:02:44 SRX-1400 RT_IDS: RT_SCREEN_SESSION_LIMIT: Src IP session limit! source: 0.0.0.0:68, destination: 255.255.255.255:67, protocol-id: 17, zone name: untrust, interface name: ge-0/0/3.0, action: drop
Dec 26 14:04:28 1.1.1.1 Dec 26 22:02:46 SRX-1400 RT_IDS: RT_SCREEN_SESSION_LIMIT: Src IP session limit! source: 0.0.0.0:68, destination: 255.255.255.255:67, protocol-id: 17, zone name: untrust, interface name: ge-0/0/3.0, action: drop
Dec 26 14:04:36 1.1.1.1 Dec 26 22:02:54 SRX-1400 RT_IDS: RT_SCREEN_SESSION_LIMIT: Src IP session limit! source: 0.0.0.0:68, destination: 255.255.255.255:67, protocol-id: 17, zone name: untrust, interface name: ge-0/0/3.0, action: drop
Dec 26 14:04:44 1.1.1.1 Dec 26 22:03:02 SRX-1400 RT_IDS: RT_SCREEN_SESSION_LIMIT: Src IP session limit! source: 0.0.0.0:68, destination: 255.255.255.255:67, protocol-id: 17, zone name: untrust, interface name: ge-0/0/3.0, action: drop

When using event mode, you can disable the log compression function by using " system syslog allow-duplicates ." 

root@SRX-1400# run show log screening_log | match repeat
 (No content)
After delete it, the "last message repeated * times" is back.
root@SRX-1400# delete system syslog allow-duplicates
root@SRX-1400# run show log screening_log |match repeat
Dec 26 15:02:02  SRX-1400 last message repeated 3 times

For more details, refer to KB21450 - [SRX] New knob allow-duplicates added in syslog hierarchy. [juniper.net]

 

Solution

The "last message repeated *" message is generated by syslogd in the control plane, so we cannot compress the message for the stream log.

 

This behavior is by design.

Summary of this function:

  1. The default action for security logs in event mode is with " last message repeated * times ."

  2. The default action for security logs in stream mode is without " last message repeated * times ."

  3. We can disable " last message repeated * times " in event mode by using system syslog allow-duplicates .

  4. We cannot enable " last message repeated * times " in stream mode.

 

Modification History

2020-07-02: Article reviewed for accuracy; no changes required; article valid and relevant