Supported Platforms
Examples: Configuring System Logging
The system log provides an excellent way of tracking all management activity on the switch by recording events such as user authentication, access authorization, and command execution. Logged command executions include commands entered by users at the CLI prompt or by client applications such as the Junos XML protocol or NETCONF XML client. Because system log files contain information about commands executed on the switch and the user who executed the commands, checking system log files for failed authentication events can help identify attempts to hack in to the switch. You can also analyze network activity by correlating executed commands with events and changes that occurred on the network at a particular time.
System log files are stored locally on the switch in the default /var/log directory.
The following example shows how to configure system log messages to record all commands entered by users and all authentication or authorization attempts. Logged commands include those entered by users at the CLI prompt and by client applications. Authentication and authorization attempts include events that are saved in the file named cli-commands and those that are sent to the terminal of a user who is logged in.
The following example shows how to log all alarms state changes to the file /var/log/alarms:
The following example shows how to configure the handling of messages of various types, as described in the comments. Information is logged to two files, to the terminal of user alex, to a remote machine, and to the console:
The following example shows how to configure the handling of messages generated when users issue Junos OS CLI commands, by specifying the interactive-commands facility at the info, notice, and warning severity levels:
The following list describes the security levels used in the example:
- info—Logs a message when users issue any command at the CLI operational or configuration mode prompt. The example writes the messages to the file /var/log/user-actions.
- notice—Logs a message when users issue the configuration mode commands rollback and commit. The example writes the messages to the terminal of user philip.
- warning—Logs a message when users issue a command that restarts a software process. The example writes the messages to the console.