When troubleshooting an issue, you may need to collect the /var/log/ from the Virtual Forwarding Plane (VFP).  Additionally, if the connectivity to the FTP / SFTP server is via the Virtual Control Plane (VCP), then you'll need to copy the logs to VCP. 

1. Log into VFP shell with root credentials. Use command 'start shell pfe network base-os fpc0'

   labroot@jtac-vm-host-180> start shell user root    
   Password:
   root@jtac-vm-host-180:/var/home/labroot # cli
   labroot@jtac-vm-host-180> start shell pfe network base-os fpc0   
   Last login: Thu Aug  1 19:35:11 UTC 2019 from 128.0.0.4 on pts/0
   root@vfp-vmx2:~#

2. Tar the logs using the command, 'tar -czf /var/tmp/filename.tgz /var/log/*'

   For the verbose output, use 'tar -cvzf /var/tmp/vfp-logs-Aug1.tgz /var/log/*'

   root@vfp-vmx2:~# tar -czf /var/tmp/vfp-logs-Aug1.tgz /var/log/*
   tar: Removing leading `/' from member names
   root@vfp-vmx2:~# cd /var/tmp/
   root@vfp-vmx2:/var/tmp# ls -l | grep vfp-logs-Aug1
   -rw-r--r--    1 root     root        628446 Aug  1 19:35 vfp-logs-Aug1.tgz
   

3. Copy the logs to the VCP using the scp command, 'scp filename [email protected]:/var/tmp/.​'

   Note: You cannot use root credentials to do scp.  You need a username and password to do it.

   root@vfp-vmx2:/var/tmp# scp vfp-logs-Aug1.tgz [email protected]:/var/tmp/.
   Could not create directory '/root/.ssh'.
   The authenticity of host '128.0.0.1 (128.0.0.1)' can't be established.
   ECDSA key fingerprint is 50:d4:92:1a:2a:c5:ab:59:97:2b:a2:cf:34:22:83:36.
   Are you sure you want to continue connecting (yes/no)? yes
   Failed to add the host to the list of known hosts (/root/.ssh/known_hosts).
   Password:
   vfp-logs-Aug1.tgz                100%  614KB 613.7KB/s   00:00    
   root@vfp-vmx2:/var/tmp#
   
   labroot@jtac-vm-host-180> file list detail /var/tmp/ | grep vfp-logs-Aug1
   -rw-r--r--  1 labroot wheel    628446 Aug 1  19:28 vfp-logs-Aug1.tgz​

2019-08-16: minor title correction.