This article describes how to create a custom syslog file that includes only certain messages for tracking or troubleshooting purposes.
Junos offers the option to create custom syslog files for tracking specific logs by using "."(dot) as regular expressions .
The following example tracks license's related messages:
set system syslog file License any any set system syslog file License match .license root@Switch# show system syslog file License { any any; match .license; } root@Switch> show log License Sep 10 15:28:50 Switch alarmd[4183]: Alarm cleared: License color=YELLOW, class=CHASSIS, reason=JBS For Class 1 devices usage requires a license Sep 10 15:28:50 Switch craftd[4184]: Minor alarm cleared, JBS For Class 1 devices usage requires a license Sep 10 15:28:53 Switch alarmd[4183]: Alarm cleared: License color=YELLOW, class=CHASSIS, reason=BGP Routing Protocol usage requires a license Sep 10 15:28:53 Switch craftd[4184]: Minor alarm cleared, BGP Routing Protocol usage requires a license Sep 10 15:28:53 Switch alarmd[4183]: Alarm set: License color=YELLOW, class=CHASSIS, reason=BGP Routing Protocol usage requires a license
set
file License any any
file License match .license
root@Switch# show system syslog file License { any any; match .license; }
root@Switch> show log License Sep 10 15:28:50 Switch alarmd[4183]: Alarm cleared: License color=YELLOW, class=CHASSIS, reason=JBS For Class 1 devices usage requires a license Sep 10 15:28:50 Switch craftd[4184]: Minor alarm cleared, JBS For Class 1 devices usage requires a license Sep 10 15:28:53 Switch alarmd[4183]: Alarm cleared: License color=YELLOW, class=CHASSIS, reason=BGP Routing Protocol usage requires a license Sep 10 15:28:53 Switch craftd[4184]: Minor alarm cleared, BGP Routing Protocol usage requires a license Sep 10 15:28:53 Switch alarmd[4183]: Alarm set: License color=YELLOW, class=CHASSIS, reason=BGP Routing Protocol usage requires a license
To track more than one message, add regular expression "|" (as OR) in brackets and between quotations.
The following example matches logs which include phrase "Alarm set: License", as well as any "Commit" activity:
set system syslog file Custom any any set system syslog file Custom match ".(Alarm set: License|UI_COMMIT)" root@Switch# show system syslog file Custom { any any; match ".(Alarm set: License|UI_COMMIT)"; } root@Switch> show log Custom Sep 10 15:42:54 Switch alarmd[4183]: Alarm set: License color=YELLOW, class=CHASSIS, reason=BGP Routing Protocol usage requires a license Sep 10 15:42:54 Switch alarmd[4183]: Alarm set: License color=YELLOW, class=CHASSIS, reason=JBS For Class 1 devices usage requires a license Sep 10 15:43:15 Switch mgd[5574]: UI_COMMIT : User 'root' requested 'commit' operation (comment: none) Sep 10 15:43:15 Switch mgd[5574]: UI_COMMIT _PROGRESS: Commit operation in progress: updating commit revision Sep 10 15:43:15 Switch mgd[5574]: UI_COMMIT _PROGRESS: Commit operation in progress: start loading commit script changes
set system syslog file Custom any any set
file Custom match ".(Alarm set: License|UI_COMMIT)"
root@Switch# show system syslog file Custom { any any; match ".(Alarm set: License|UI_COMMIT)"; } root@Switch> show log Custom Sep 10 15:42:54 Switch alarmd[4183]: Alarm set: License color=YELLOW, class=CHASSIS, reason=BGP Routing Protocol usage requires a license Sep 10 15:42:54 Switch alarmd[4183]: Alarm set: License color=YELLOW, class=CHASSIS, reason=JBS For Class 1 devices usage requires a license Sep 10 15:43:15 Switch mgd[5574]: UI_COMMIT : User 'root' requested 'commit' operation (comment: none) Sep 10 15:43:15 Switch mgd[5574]: UI_COMMIT _PROGRESS: Commit operation in progress: updating commit revision Sep 10 15:43:15 Switch mgd[5574]: UI_COMMIT _PROGRESS: Commit operation in progress: start loading commit script changes
To suppress specific logs from the default syslog message file instead, refer to KB22177 - How to filter two or more specific messages from being written to the syslog file? [juniper.net] .