This article explains how to gather the /var/log/* from SPC3 PIC X incase you see PIC X showing offline. Following logs would help in-order to troubleshoot/root-cause issues related to SPC3.

Here in this case PIC 1 is showing offline for SPC3 card in slot 2 of the device.

root@device-re0> show chassis fpc pic-status 2
Jan 31 00:39:41
Slot 2   Online       SPC3                                         
  PIC 0  Online       SPC3-PIC
  PIC 1  Offline      SPC3-PIC

Proceed with below steps to collect the logs from the offline PIC

1. Get into Shell with user root

Start shell user root
<password>
root@device-re0:/var/home/labroot # hostname
device-re0

2. We need go to cty for FPC 2 PIC 1

E.g

root@device-re0:/var/home/labroot # cty -n fpc2 pic1

<<<<<<<<< Press enter to get below prompt

root@device-re0-fpc2:~#
root@device-re0-fpc2:~# hostname
device-re0-fpc2.pic1

We won’t be seeing any logs, under the CTY command incase the PIC is offline. However, we could see Linux is still up, even though PIC 1 was offline.

3. Run below command to check the running processes :

root@device-re0-fpc2:~# top -n1 -b <<<<<<<< collect the output

Collect the mcelog as well :

root@device-re0-fpc2:/var/log# mcelog --client

4. Collect the logs, using below procedure.

root@device-re0-fpc2:~# cd /var/log/

root@device-re0-fpc2:/var/log# ls -lrt
total 91232
-rw-r--r-- 1 root root 224746 Oct 12 12:24 dmesg.2
-rw-r----- 1 root root 10485805 Dec 18 14:57 cron.log.1
-rw-r----- 1 root root 1049616 Jan 10 17:55 sensord.log.3
-rw-r----- 1 root root 531569 Jan 18 17:10 syslog.10.gz
-rw-r----- 1 root root 531571 Jan 18 17:35 debug.10.gz
-rw-r----- 1 root root 531512 Jan 18 18:32 daemon.log.10.gz
-rw-r----- 1 root root 1049616 Jan 18 22:55 sensord.log.2
-rw-r----- 1 root root 531390 Jan 19 23:25 syslog.9.gz
<Clipped>

root@device-re0-fpc2:/var/log# tar -zcf ./var-log-fpc2_pic1.tgz /var/log/* <<<<<<<< You could name it, var-log-fpc2_pic1.tgz
tar: Removing leading `/' from member names

root@device-re0-fpc2:/var/log# ls -Fl var-log*
-rw-r--r-- 1 root root 18693312 Jan 30 23:13 var-log- fpc2_pic1.tgz

5. Copy the file to RE 0 /var/tmp folder.

root@device-re0-fpc2:/var/log# scp var-log- fpc2_pic1.tgz 128.0.0.1:/var/tmp/
The authenticity of host '128.0.0.1 (128.0.0.1)' can't be established.
ECDSA key fingerprint is SHA256:4ROOApzWuak7JNvivPKH0Mvy/IZVXptLM8MnCJQe3to.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added '128.0.0.1' (ECDSA) to the list of known hosts.
Password:
var-log- fpc2_pic1.tgz

Note:- For SRX devices cluster please use "127.0.0.1" to copy.

root@device-re0-fpc2:/var/log# scp var-log- fpc2_pic1.tgz 127.0.0.1:/var/tmp/

Once the file is copied, you can remove the file from PIC1 :

root@device-re0-fpc2:/var/log# rm var-log- fpc2_pic1.tgz

Use Ctrl+c to come out of it

Check in CLI

labroot@device-re0> file list /var/tmp/ detail | match var-log- fpc2_pic1.tgz
-rw-r--r-- 1 root wheel 18693312 Jan 30 23:13 var-log- fpc2_pic1.tgz

Share the above collected information/logs with JTAC to troubleshoot/root-cause the SPC3 related issues.