This article shows the source of these user id log messages on the SRX.
On the /var/log/messages or userid file directory we might see some of these logs:
Jan 3 10:59:42 srx5800-1 useridd[12596]: USERID_SUBMODULE: domain <domain.name>
Jan 3 10:59:42 srx5800-1 useridd[12596]: USERID_SUBMODULE: total_cnt 1116
Jan 3 10:59:42 srx5800-1 useridd[12596]: USERID_SUBMODULE: ad_cnt 0
Jan 3 10:59:42 srx5800-1 useridd[12596]: USERID_SUBMODULE: cp_cnt 0
Jan 3 10:59:42 srx5800-1 useridd[12596]: USERID_SUBMODULE: jims_cnt 1116
Jan 3 10:59:42 srx5800-1 useridd[12596]: USERID_SUBMODULE: init_cnt 0
Jan 3 10:59:42 srx5800-1 useridd[12596]: USERID_SUBMODULE: valid_cnt 1116
Jan 3 10:59:42 srx5800-1 useridd[12596]: USERID_SUBMODULE: invalid_cnt 0
Jan 3 10:59:42 -srx5800-1 useridd[12596]: USERID_SUBMODULE: pending_cnt 0
Jan 3 10:59:42 srx5800-1 useridd[12596]: USERID_SUBMODULE: lsys 0
Jan 3 10:59:42 srx5800-1 useridd[12596]: USERID_SUBMODULE: domain <domai.name>
No only we see these logs but we also see them in waves, these might overflow the log files, so it's good to direct them to a different file.
So what are these logs?
All of these are in an informative level logs:
useridd[12596]: USERID_SUBMODULE: ae_cnt 0 = Clear pass counter
useridd[12596]: USERID_SUBMODULE: cp_cnt 0 = Auth entry counter
useridd[12596]: USERID_SUBMODULE: jims_cnt 1116 = JIMS counter
useridd[12596]: USERID_SUBMODULE: init_cnt 0 = Initiation counter
useridd[12596]: USERID_SUBMODULE: valid_cnt 1116 = Valid auth counters
useridd[12596]: USERID_SUBMODULE: invalid_cnt 0 = Invalid counters
useridd[12596]: USERID_SUBMODULE: pending_cnt 0 = Pending counters
useridd[12596]: USERID_SUBMODULE: domain <domain.name> = Domain name
So where do these come from?
By the log itself it comes from the JIMS authentication server that the SRX currently has.
This counts information regarding JIMS, it is not a critical or any dangerous logs. Only something that you will see because of your syslog configuration.
if you don't want to see these informational JIMS logs anymore, you can reconfigure syslog to not log or send these notice logs (code 5) or send them to a different directory.