This article explains the procedure to configure IDP logs on the SRX device and how to send them to the SDI(Security Director Insight - Log Collector) and how to verify the logs status from SDI.

• To turn on logging, first turn on notification to log attacks:

# set security idp idp-policy recommended rulebase-ips rule 1 then notification log-attacks

Enable security login

Using stream mode:

root@srx# show security log
mode stream;
stream IDP_Log {
  format syslog;
  category idp;
  host {
    10.2.3.4;
  }
  source-address 192.168.1.2;
}

Here,

"host 10.2.3.4" --> SRX interface where it sends the logs to SDI

"source-address 192.168.1.2" --> SDI interface where the SRX logs are received

Using event mode:

root@srx# show security log
mode event;

root@srx# show system syslog
file IDP_log {
 any any;
 match RT_IDP;
}

• If you are using event mode, you can view the signatures that are triggered and attacks that are matched by executing the following command:

> show log IDP_Log

• If you are using stream mode, you can review the logs in the external collector.
• If you are not receiving as many messages as required, disable log suppression:

Note: This is not recommended for a prolonged time, as it will cause a lot of logs to be created over a short time; depending on traffic and attacks.# set security idp sensor-configuration log suppression to disable

================================================================================================

• To test at the SDI end whether the logs are being received or not, we need to execute the below tcpdump command.

# tcpdump -i eth0 -vv -nn -xX host <device_ip_address> and port 514

• However, the above tcpdump has to be run on the SDI CLI using the cysupport user login. To get into the cysupport user, users must follow the steps below.

:CORE# server

:CORE# set support enable on
Remote support duration (In Hours): 24           ------> Here you have to enter the hours for which the cysupport account will be active. For eg., 24. This means the cysupport account will be active for 24 hours.

:CORE# show support-access-key plain             ------> This command provides the support account access key.

• Now, users have to provide this support account access key to JTAC. JTAC in return provides the password.
• Now, users have to log in to SDI again. This time, instead of "admin", users should use "cysupport" as the user and the password would be the JTAC-provided password.
• Once the user log in to SDI as cysupport user, they can run the above provided tcpdump command to check.
• Users can also use the tcpdump command as below to filter for specific event name.

• If users want to filter the logs with RT_FLOW events:

# tcpdump -i eth0 -vv -nn -xX host <device_ip_address> and port 514 | grep -i "RT_FLOW"

• If users want to filter the logs with RT_IDP events:

# tcpdump -i eth0 -vv -nn -xX host <device_ip_address> and port 514 | grep -i "RT_IDP"