Description

This KB article will helps you to verify unstructured logs coming on SDI-LC from Junos devices. 

Symptoms

Unstructured logs wont be visibile over security director UI, as unstructured log parsing will fail on SDI-LC itself

Solution

Step 1: below log file needs to be reviewed for log parsing error 

# tail -f /var/log/cyos/jingest/jingest.log

Note: You need to login on SDI-LC through cysupport user by following [Internal Only] [Security Director] How to get CLI access to Security Director Insight

 

Step 2:  under Jingest.log you can see below error for parsing failure.

2023-03-21 14:38:45 ERROR LogProcessingEngine:121 - Error while processing the message
java.lang.StringIndexOutOfBoundsException: String index out of range: -2
    at java.lang.String.substring(String.java:1967)

Its mostly because unstructured data coming from Junos devices. We can capture raw data coming from devices via tcpdump utility on SDI and follow below steps to find unstructured data

# tcpdump -nn -vv -i any port 514 >> testsyslogdata.txt


Step 3: To capture unstructured data from raw logs
Note: 1st command will remove structured data, 2nd command will remove hexamdecimal related lines, 3rd step will remove line related to length: 1472

# grep -v "\[" testsyslogdata.txt > file1
# grep -v ":  " file1 | grep -v Facility > file2
# grep -v "length: 1472" file2 > file3
# cat file3 | more 

 

Note : If you face any issues, please contact JUNIPER JTAC Support for assistance.

Modification History

2024-02-04: Article published