Description

Sending logs for logical system to external syslog server

Symptoms

Sending logs for logical system to external syslog server

Solution

Configuration for Traffic Logging for logical system :
 

root@jtac-srx4600# set logical-systems LSYS1 security log mode stream
root@jtac-srx4600# set logical-systems LSYS1 security log source-interface <source_interface>      
root@jtac-srx4600# set logical-systems LSYS1 security log stream LSYS1_Stream1 format sd-syslog
root@jtac-srx4600# set logical-systems LSYS1 security log stream LSYS1_Stream1 category all
root@jtac-srx4600# set logical-systems LSYS1 security log stream LSYS1_Stream1 host <host_IP> 
root@jtac-srx4600# set logical-systems LSYS1 security log stream LSYS1_Stream1 host port 514


Other options like routing-instance and protocol such as tcp,udp and tls can also be used if needed

[edit]
root@jtac-srx4600# set logical-systems LSYS1 security log stream LSYS1_Stream1 ?
Possible completions:
  <[Enter]>            Execute this command
+ apply-groups         Groups from which to inherit configuration data
+ apply-groups-except  Don't inherit configuration data from these groups
> category             Selects the type of events that may be logged
> file                 Security log file options for logs in local file
> filter               Selects the filter to filter the logs to be logged
  format               Specify the log stream format
> host                 Destination to send security logs to
> rate-limit           Rate-limit for security logs
  severity             Severity threshold for security logs
  source-address       Source ip address used when exporting security logs
> time-format          Configure year or millisecond for syslog
> transport            Set security log transport settings
  |                    Pipe through a command
[edit]
root@jtac-srx4600# set logical-systems LSYS1 security log stream LSYS1_Stream1 host ?
Possible completions:
  <ipaddr>             IP address/Host name
+ apply-groups         Groups from which to inherit configuration data
+ apply-groups-except  Don't inherit configuration data from these groups
  port                 Host port number
  routing-instance     Routing-instance name
[edit]
[edit]
root@jtac-srx4600-r2028# set logical-systems LSYS1 security log stream LSYS1_Stream1 transport protocol ?
Possible completions:
  tcp                  TCP transfer for log
  tls                  TLS transfer for log
  udp                  UDP transfer for log
[edit]


The below sample outputs displays information about the resources allocated to the logical system in a security profile.
For each resource specified, the number used by the logical system and the configured maximum and reserved values are displayed.


root@jtac-srx4600> show system security-profile security-log-stream-number logical-system all
logical system name   security profile name       usage    reserved     maximum
root-logical-system   Default-Profile                 1           0           3
LSYS1                 sp1                             0           1           3
LSYS2                 sp2                             1           0           3

 

Modification History

2024-09-21 : Article Created

Related Information

https://www.juniper.net/documentation/us/en/software/junos/cli-reference/topics/ref/statement/security-edit-logical-system-security-log-stream.html