Description

Data-plane logs are generated at the Packet Forwarding Engine (PFE) level and if the security log configured with Stream mode the logs are sent from the PFE to an external syslog server via a revenue port.

After configuring the screen options the SRX don't send any of the screen logs to external syslog server as the category is configured with nat only which means that Network Address Translation (NAT) events only are logged.
 

security {
  log {
    mode stream;
    format sd-syslog;
    source-address 1.1.1.1;
    stream SYSLOG-SERVER {
      format syslog;
      category nat;
      host {
        2.2.2.2;
        port 514;
      }
    }

 

 

Symptoms

Screen logs not send to external syslog server.

Solution

Add category screen under the security log stream server to log the screen events :

set security log stream SYSLOG-SERVER category screen
 

Modification History

2024-09-09 : Article Created