An MX-VC configured with the following syslog:
set system syslog user * any emergency
set system syslog host 192.168.1.108 any any
set system syslog host 192.168.1.108 log-prefix MX-VC
set system syslog file default-log-messages any info
set system syslog file default-log-messages structured-data
set system syslog file interactive-commands interactive-commands any
set system syslog file jtac any notice
set system syslog file jtac archive size 10m
set system syslog file jtac archive files 10
set system syslog file jtac archive world-readable
set system syslog file messages any info
set system syslog file messages authorization info
set system syslog time-format year
set system syslog time-format millisecond
Is seeing the message log filled with JUNOScript messages continuously. The logs are the following:
labroot@jtac-MX480-r141> show log messages | last 30
Nov 10 06:54:10.004 2024 jtac-MX480-r141 mgd[65947]: UI_CMDLINE_READ_LINE: User '(authentication in progress)', command 'rpc command .set auth environment user root logname root host jtac-MX480-r141 agent mgd current-directory /var/tmp pid 91534 ppid 15464 '
Nov 10 06:54:10.004 2024 jtac-MX480-r141 mgd[65947]: UI_JUNOSCRIPT_CMD: User '(authentication in progress)' used JUNOScript client to run command 'request-authentication user=root logname=root host=jtac-MX480-r141 agent=mgd current-directory=/var/tmp pid=91534 ppid=15464'
Nov 10 06:54:10.007 2024 jtac-MX480-r141 mgd[65947]: UI_AUTH_EVENT: Authenticated user 'root' assigned to class 'super-user'
Nov 10 06:54:10.007 2024 jtac-MX480-r141 mgd[65947]: UI_LOGIN_EVENT: User 'root' login, class 'super-user' <unknown>[65947], ssh-connection '', client-mode 'junoscript'
Nov 10 06:54:10.009 2024 jtac-MX480-r141 mgd[65947]: UI_CMDLINE_READ_LINE: User 'root', command 'command rpc rpc command show virtual-chassis vc-port no-forwarding '
Nov 10 06:54:10.010 2024 jtac-MX480-r141 mgd[65947]: UI_JUNOSCRIPT_CMD: User 'root' used JUNOScript client to run command 'get-virtual-chassis-port-information'
Nov 10 06:54:10.013 2024 jtac-MX480-r141 mgd[65947]: UI_JUNOSCRIPT_CMD: User 'root' used JUNOScript client to run command 'request-end-session'
Nov 10 06:54:10.013 2024 jtac-MX480-r141 mgd[65947]: UI_LOGOUT_EVENT: User 'root' logout
There is no functional impact, but the logs are filling up with the aforementioned messages.
Similarly, if the MX VC is running TACACS for Accounting:
set system accounting events login
set system accounting events change-log
set system accounting events interactive-commands
set system accounting destination tacplus server 10.3.200.40 secret "$9$iHfz9Cu1Eyp0yKWxwsZUjHP5z36AuO"
set system accounting destination tacplus server 10.3.200.40 source-address 10.85.164.209
For login and/or interactive-commands, the TACACS server will see logs tied to the same commands being run:
lab@sf-ubuntu:/var/log$ tail -f tac_plus.acct
Jan 18 16:08:40 10.85.164.209 root non-tty Unknown host - non-tty stop task_id=3 service=shell session_pid = 61020 cmd=request-end-session<cr>
Jan 18 16:08:40 10.85.164.209 root non-tty Unknown host - non-tty stop task_id=1 service=shell session_pid = 61020 elapsed_time=1737216535 cmd=logout
Jan 18 16:08:45 10.85.164.209 root non-tty Unknown host - non-tty stop task_id=1 service=shell session_pid = 61021 cmd=command rpc rpc command show virtual-chassis vc-port no-forwarding <cr>
Jan 18 16:08:45 10.85.164.209 root non-tty Unknown host - non-tty stop task_id=2 service=shell session_pid = 61021 cmd=get-virtual-chassis-port-information<cr>
Jan 18 16:08:45 10.85.164.209 root non-tty Unknown host - non-tty stop task_id=3 service=shell session_pid = 61021 cmd=request-end-session<cr>
Jan 18 16:08:46 10.85.164.209 root non-tty Unknown host - non-tty stop task_id=1 service=shell session_pid = 61021 elapsed_time=1737216540 cmd=logout
Jan 18 16:08:46 10.85.164.209 root non-tty Unknown host - non-tty stop task_id=1 service=shell session_pid = 61022 cmd=command rpc rpc command show virtual-chassis vc-port no-forwarding <cr>
Jan 18 16:08:46 10.85.164.209 root non-tty Unknown host - non-tty stop task_id=2 service=shell session_pid = 61022 cmd=get-virtual-chassis-port-information<cr>
Jan 18 16:08:46 10.85.164.209 root non-tty Unknown host - non-tty stop task_id=3 service=shell session_pid = 61022 cmd=request-end-session<cr>
Jan 18 16:08:46 10.85.164.209 root non-tty Unknown host - non-tty stop task_id=1 service=shell session_pid = 61022 elapsed_time=1737216540 cmd=logout
The logs are part of a change to MX VC tied to adding support for Telemetry and queue statistics in 21.1R1. The commands are run from within daemons to gather statistical data. It cannot be disabled or turned off and there is no code change to modify the behavior available.
To avoid seeing the logs in the messages log file, the following condition can be configured:
set system syslog file messages match "!(.*get-virtual-chassis-port-information.*|.*request-end-session.*|.*show virtual-chassis vc-port no-forwarding.*)"
For a syslog host, the same match can be set:
set system syslog host 192.168.1.108 match "!(.*get-virtual-chassis-port-information.*|.*request-end-session.*|.*show virtual-chassis vc-port no-forwarding.*)"
Note however that the match rules do add a level of CPU to the RE as ever log written or sent needs to be checked.
For TACACS, there is no filter option available. If interactive-commands is removed:
delete system accounting events interactive-commands
The server will no longer see the commands run. But, it will still have the logout events:
Jan 18 16:09:46 10.85.164.209 root non-tty Unknown host - non-tty stop task_id=1 service=shell session_pid = 61549 elapsed_time=1737216600 cmd=logout
Jan 18 16:09:46 10.85.164.209 root non-tty Unknown host - non-tty stop task_id=1 service=shell session_pid = 61550 elapsed_time=1737216600 cmd=logout
Jan 18 16:09:51 10.85.164.209 root non-tty Unknown host - non-tty stop task_id=1 service=shell session_pid = 61552 elapsed_time=1737216605 cmd=logout
Jan 18 16:09:51 10.85.164.209 root non-tty Unknown host - non-tty stop task_id=1 service=shell session_pid = 61554 elapsed_time=1737216605 cmd=logout
Jan 18 16:09:57 10.85.164.209 root non-tty Unknown host - non-tty stop task_id=1 service=shell session_pid = 61555 elapsed_time=1737216610 cmd=logout
Jan 18 16:09:57 10.85.164.209 root non-tty Unknown host - non-tty stop task_id=1 service=shell session_pid = 61557 elapsed_time=1737216610 cmd=logout
To remove those, login events would also have to be deleted from the configuration:
delete system accounting events login