The logs from Juniper SRX devices can be forwarded to an external Syslog server, such as JSA.
SRX devices can forward two types of logs to a JSA device. One type of logs is from the Control Plane and the other type is from the Data Plane.
JunOS supports sending logs in both the structured and unstructured formats:Control Plane logs can be sent via the fxp0 port or optionally via another source interface but are always unstructured. Data plane (Security) logs are structured if sent via stream mode to an egress revenue port.
When using JSA it is recommended to send both the control plane and data plane logs out a revenue port. This way, the Juniper JunOS DSM can parse both the structured and unstructured logs.
Note: JSA expects the SRX logs in the following specific formats: Control Plane Logs in the Unstructured Syslog format. Data Plane Logs in the Structured Syslog format.
The following sample SRX configuration is for sending logs to JSA at example IP (10.10.10.1):
For Control plane logging: root@srx# set system syslog user * any emergency root@srx# set system syslog host 10.10.10.1 any any root@srx# set system syslog host 10.10.10.1 change-log none root@srx# set system syslog host 10.10.10.1 interactive-commands none root@srx# set system syslog host 10.10.10.1 port <xxx>
Note: By default, the syslog is listening on port 514.
For Data plane logging:set security log mode streamset security log format sd-syslogset security log source-address <SRX data plane IP>set security log stream securitylog category allset security log stream securitylog host <JSA ip address>set security log stream securitylog host port 514