Description

The logs from Juniper SRX devices can be forwarded to an external Syslog server, such as JSA. 

Symptoms

SRX devices can forward two types of logs to a JSA device. One type of logs is from the Control Plane and the other type is from the Data Plane. 

  1. Control Plane - These are the logs that are generated by the following parameters:
       a. User Processes - In particular flowd logs and session information. 
       b. Interactive commands - user typed CLI commands.
       c. System daemons - like KMD, MGD, SNMPD, and so on.
  2. Data Plane - These are the traffic logs, which including the following:
       a. Session, IDP, UTM

Solution

JunOS supports sending logs in both the structured and unstructured formats:
Control Plane logs can be sent via the fxp0 port or optionally via another source interface but are always unstructured. 
Data plane (Security) logs are structured if sent via stream mode to an egress revenue port. 

When using JSA it is recommended to send both the control plane and data plane logs out a revenue port. This way, the Juniper JunOS DSM can parse both the structured and unstructured logs. 

Note: JSA expects the SRX logs in the following specific formats: 
 Control Plane Logs in the Unstructured Syslog format. 
 Data Plane Logs in the Structured Syslog format.

The following sample SRX configuration is for sending logs to JSA at example IP (10.10.10.1):

For Control plane logging: 
root@srx# set system syslog user * any emergency 
root@srx# set system syslog host 10.10.10.1 any any 
root@srx# set system syslog host 10.10.10.1 change-log none 
root@srx# set system syslog host 10.10.10.1 interactive-commands none 
root@srx# set system syslog host 10.10.10.1 port <xxx>

Note: By default, the syslog is listening on port 514. 

For Data plane logging:
set security log mode stream
set security log format sd-syslog
set security log source-address <SRX data plane IP>
set security log stream securitylog category all
set security log stream securitylog host <JSA ip address>
set security log stream securitylog host port 514

Modification History

2024-12-04 : Article Created