Junos Syslog Engine for Salt

The Junos syslog engine requires installing the pyparsing and twisted Python modules on the server where the engine runs. This documentation assumes the Junos syslog engine is running on the Salt master. For detailed instructions on installing the prerequisites and enabling the Junos syslog engine, see Configuring the Junos Syslog Engine in the Salt for Junos OS Quick Start Guide.

To use the Junos syslog engine, you must configure the device running Junos OS to send its syslog messages to a designated port on the Salt master. You can configure the device to send all events or only events corresponding to a specific facility or message severity level.

To send all events, configure any any to indicate all facilities and all message severity levels.

To send, for example, only security events with a severity level of info or higher, configure security info.

For more information about system logging facilities and message severity levels, see Junos OS System Logging Facilities and Message Severity Levels.

To enable the Junos syslog engine, you must configure the engine under the engines key in the Salt master configuration file and specify the same port that you configured on the devices running Junos OS.

To apply the configuration, you must restart the Salt master, which automatically starts the Junos syslog engine process. The Junos syslog engine then listens for Junos OS syslog messages on the specified port, extracts the event information, and publishes it in Salt format on the Salt event bus. To create and configure reactors that automatically take action when specific events occur, see Configuring Salt Reactors for Junos OS Events.

Events published to the Salt event bus have two components: the event tag and the data. Junos OS events use the following default event tag (or event topic) syntax:

The event tag for Junos OS events must always start with jnpr/syslog, but you can customize the remaining fields by defining the topic parameter in the engine configuration and specifying the fields to include. For example, the following configuration generates event tags that include the device’s IP address, the process that generated the message, and the event:

When you configure this syntax, the tag for a completed commit operation event might be:

The event tag fields can include any combination of the following fields after jnpr/syslog/:

• daemon

• event

• hostip

• hostname

• message

• pid

• priority

• raw (the raw event data forwarded from the device)

• severity

• timestamp

As described in How to Enable the Junos Syslog Engine, you can configure which syslog events the device running Junos OS sends to the Junos syslog engine. By default, the Junos syslog engine publishes the event data for all received events on the Salt event bus. You can also customize the Junos syslog engine to only subscribe to certain processes by configuring the daemon parameter in the engine configuration. When you configure this parameter, the Junos syslog engine only publishes the events pertaining to those processes on the Salt event bus.

The following Salt engine configuration subscribes the Junos syslog engine to events from the management process (mgd) and the routing protocol process (rpd):

After restarting the salt-master process to apply the configuration, the Junos syslog engine only publishes events from these two processes on the Salt event bus.

Salt runners execute modules on the Salt master rather than on the minions. You execute runners by using the salt-run command. To view the events on the Salt master event bus in real time, execute the following command, which displays the events in the terminal:

If you want to quickly trigger an event, you can ping the minion as shown in the following example:

The corresponding event bus output shows the Salt job and the minion’s response.

To test the Junos syslog engine configuration, you can execute an operation on the device running Junos OS. The device must be configured to send messages with that operation’s facility and that severity level to the Junos syslog engine. In addition, the engine must be subscribed to messages from that process (or all processes, which is the default). When you execute the operation, the Junos syslog engine publishes the event to the Salt event bus.