This KB article will help you investigate the Security Director Cloud Traffic/Session Logs visibility issue.

Security logs not appearing under Monitor > Logs > Session page in Security Director Cloud

1) Check status of deploy-ca-certificate job by running below command of the affected device

show security pki ca-certificate

Look for "Certificate identifier: sd_cloud_ca"

[email protected]> show security pki ca-certificate 
LSYS: root-logical-system
  CA profile: sd_cloud_ca
Certificate identifier: sd_cloud_ca
  Issued to: SDonCloud Root Certificate Authority, Issued by: C = US, O = Juniper Networks, OU = SDonCloud, ST = California, CN = SDonCloud Root Certificate Authority, L = Sunnyvale
  Validity:
    Not before: 12- 1-2021 04:44 UTC
    Not after: 12- 1-2031 05:44 UTC
  Public key algorithm: rsaEncryption(2048 bits)
  Keypair Location: Keypair generated locally

show security pki local-certificate

Look for "Certificate identifier: sd_cloud_local"

> show security pki local-certificate
LSYS: root-logical-system
Certificate identifier: sd_cloud_local
  Issued to: aaaa1111-11bb-22cc-33dd-4444bbbbdddd.juniper.net, Issued by: C = US, O = Juniper Networks, OU = SDonCloud, ST = California, CN = SDonCloud Root Certificate Authority, L = Sunnyvale
  Validity:
    Not before: 01- 9-2024 07:06 UTC
    Not after: 02- 7-2025 08:06 UTC
  Public key algorithm: rsaEncryption(2048 bits)
  Keypair Location: Keypair generated locally

Note: If the 'deploy-ca-certificate' job failed in the past in the Security Director Cloud, then we can select and Retry to push the profile to device.

2) Ensure "Security log" configuration is pushed to the device, from the device ILP pages. Go to the Device page, From the "More" dropdown, select "Enable Security logs" -> Select revenue interface (reth), enable logging "click Ok". This will create a Deploy job. For more details refer Security Logs Configuration  

Example of Security Log Configuration:

set security log mode stream
set security log format sd-syslog
set security log source-interface ge-0/0/0.0     <-------Should be revenue interface
set security log stream sd-cloud-logs category all
set security log stream sd-cloud-logs host virginia-frankfurt-logging.sdcloud.juniperclouds.net
set security log stream sd-cloud-logs host port 6514
set security log stream sd-cloud-logs transport division line-based
set security log stream sd-cloud-logs transport protocol tls
set security log stream sd-cloud-logs transport tls-profile syslog-profile

3) Make sure device configuration Status is "In Sync" status, wait if the status is "Sync in progress" and Select "All" from the GroupBy.
 

4) If still do not see the device, then "Resynchronize the device" manually from the UI and re-attempt 

5) Check if port 6514 is open from the device by running the below command on the affected device:

[email protected]> telnet srx.sdcloud.juniperclouds.net port 6514       
Trying 44.x.x.x...
Connected to srx.sdcloud.juniperclouds.net.
Escape character is '^]'.

Note: If srx.sdcloud.juniperclouds.net FQDN is not getting resolved on the SRX device then we need to review the DNS config or manually configure them on the SRX device or configure the SD Cloud IP address for host. 

If you face some issue in 6514 connectivity, please restart the service in SRX from CLI:

restart security-log 

This will re-establish the 6514 connection with SD Cloud.

6) Check security flow sessions for port 6514 in SRX CLI:

"show security flow session destination-port 6514" 

Example: 
[email protected]> show security flow session destination-port 6514 
Session ID: 17183593743, Policy name: Test1/16, Timeout: 288, Session State: Valid
 In: 10.x.x.40/10004 --> 44.x.x.x/6514;tcp, Conn Tag: 0x0, If: .local..0, Pkts: 11498, Bytes: 9110955, 
 Out: 44.x.x.88/6514 --> 10.x.x.x/10004;tcp, Conn Tag: 0x0, If: ge-0/0/0.0, Pkts: 9400, Bytes: 379141, 

7) Make sure log interface selected is the correct one from where the traffic will be forwarded to SD Cloud 
 

8) Ensure the Security log, Security PKI, and Services SSL are not deactivated by user error on the device. 

9) Ensure log session-init/ session-close is enabled on the firewall rule to see the RT_FLOW logs.

10) Check SRX RE log messages (usually show log messages) for "RT_SYSTEM: RTLOG_CONN_ERROR: Connection error sd-cloud-logs" or other RTLOG_CONN_ERROR messages.

11) If these do not work, check the CPU on the device. If the CPU on the SRX device is high, the logs will not be seen on the SDC as well. You can restart the security-log daemon on the SRX to reload the security-log process which is responsible for generating security logs on the SRX.

Command: restart security-log

Note: If you face any further issues, please contact JUNIPER JTAC Support for assistance.
 

2024-07-05 : Article Created
2024-10-03: Added a note.

2024-01-16: Added Example of Security Log Configuration and restart security-log command.

2024-11-06: added note to check  sd_cloud_local certificate

2024-11-14: added note about RTLOG_CONN_ERROR