Description

This article shows the source of these user id log messages on the SRX.

On the /var/log/messages or userid file directory we might see some of these logs:

 

Jan 3 10:59:42 srx5800-1 useridd[12596]: USERID_SUBMODULE: domain <domain.name>

Jan 3 10:59:42 srx5800-1 useridd[12596]: USERID_SUBMODULE: total_cnt 1116

Jan 3 10:59:42 srx5800-1 useridd[12596]: USERID_SUBMODULE: ad_cnt 0

Jan 3 10:59:42 srx5800-1 useridd[12596]: USERID_SUBMODULE: cp_cnt 0

Jan 3 10:59:42 srx5800-1 useridd[12596]: USERID_SUBMODULE: jims_cnt 1116

Jan 3 10:59:42 srx5800-1 useridd[12596]: USERID_SUBMODULE: init_cnt 0

Jan 3 10:59:42 srx5800-1 useridd[12596]: USERID_SUBMODULE: valid_cnt 1116

Jan 3 10:59:42 srx5800-1 useridd[12596]: USERID_SUBMODULE: invalid_cnt 0

Jan 3 10:59:42 -srx5800-1 useridd[12596]: USERID_SUBMODULE: pending_cnt 0

Jan 3 10:59:42 srx5800-1 useridd[12596]: USERID_SUBMODULE: lsys 0

Jan 3 10:59:42 srx5800-1 useridd[12596]: USERID_SUBMODULE: domain <domai.name>

 

No only we see these logs but we also see them in waves, these might overflow the log files, so it's good to direct them to a different file.

So what are these logs?

Symptoms

  • /var/log/<messages or userid> is flooded with these logs.
  • No traffic impact is seen.
  • No alarms or errors on the SRX.

Solution

All of these are in an informative level logs:

 

useridd[12596]: USERID_SUBMODULE: ae_cnt 0 = Clear pass counter

useridd[12596]: USERID_SUBMODULE: cp_cnt 0 = Auth entry counter

useridd[12596]: USERID_SUBMODULE: jims_cnt 1116 = JIMS counter

useridd[12596]: USERID_SUBMODULE: init_cnt 0 = Initiation counter

useridd[12596]: USERID_SUBMODULE: valid_cnt 1116 = Valid auth counters

useridd[12596]: USERID_SUBMODULE: invalid_cnt 0 = Invalid counters

useridd[12596]: USERID_SUBMODULE: pending_cnt 0 = Pending counters

useridd[12596]: USERID_SUBMODULE: domain <domain.name> = Domain name

 

So where do these come from?

 

By the log itself it comes from the JIMS authentication server that the SRX currently has.

This counts information regarding JIMS, it is not a critical or any dangerous logs. Only something that you will see because of your syslog configuration.

if you don't want to see these informational JIMS logs anymore, you can reconfigure syslog to not log or send these notice logs (code 5) or send them to a different directory.

Modification History

2024-01-27 : Article Created