Step 1: below log file needs to be reviewed for log parsing error
# tail -f /var/log/cyos/jingest/jingest.log
Note: You need to login on SDI-LC through cysupport user by following [Internal Only] [Security Director] How to get CLI access to Security Director Insight
Step 2: under Jingest.log you can see below error for parsing failure.
2023-03-21 14:38:45 ERROR LogProcessingEngine:121 - Error while processing the message java.lang.StringIndexOutOfBoundsException: String index out of range: -2 at java.lang.String.substring(String.java:1967)
Its mostly because unstructured data coming from Junos devices. We can capture raw data coming from devices via tcpdump utility on SDI and follow below steps to find unstructured data
# tcpdump -nn -vv -i any port 514 >> testsyslogdata.txt
Step 3: To capture unstructured data from raw logsNote: 1st command will remove structured data, 2nd command will remove hexamdecimal related lines, 3rd step will remove line related to length: 1472
# grep -v "\[" testsyslogdata.txt > file1 # grep -v ": " file1 | grep -v Facility > file2 # grep -v "length: 1472" file2 > file3 # cat file3 | more
Note : If you face any issues, please contact JUNIPER JTAC Support for assistance.