Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

header-navigation
keyboard_arrow_up
close
keyboard_arrow_left
Junos CLI Reference
Table of Contents Expand all
list Table of Contents
file_download PDF
{ "lLangCode": "en", "lName": "English", "lCountryCode": "us", "transcode": "en_US" }
English
keyboard_arrow_right

show security alarms

date_range 19-Nov-23

Syntax

content_copy zoom_out_map
show security alarms
<detail>
<alarm-id id-number>
<alarm-type [ types ]>
<newer-than YYYY-MM-DD.HH:MM:SS>
<older-than YYYY-MM-DD.HH:MM:SS>
<process process>
<severity severity>

Description

Display the alarms that are active on the device. Run this command when the CLI prompt indicates that a security alarm has been raised, as shown here:

content_copy zoom_out_map
[1 SECURITY ALARM] user@host#

Options

none

Display all active alarms.

detail

(Optional) Display detailed output.

alarm-id id-number

(Optional) Display the specified alarm.

alarm-type [ types ]

(Optional) Display the specified alarm type or a set of types.

You can specify one or more of the following alarm types:

  • authentication

  • cryptographic-self-test

  • decryption-failures

  • encryption-failures

  • ike-phase1-failures

  • ike-phase2-failures

  • key-generation-self-test

  • non-cryptographic-self-test

  • policy

  • replay-attacks

newer-than YYYY-MM-DD.HH:MM:SS

(Optional) Display active alarms that were raised after the specified date and time.

older-than YYYY-MM-DD.HH:MM:SS

(Optional) Display active alarms that were raised before the specified date and time.

process process

(Optional) Display active alarms that were raised by the specified system process.

severity severity

(Optional) Display active alarms of the specified severity.

You can specify the following severity levels:

  • alert

  • crit

  • debug

  • emerg

  • err

  • info

  • notice

  • warning

Required Privilege Level

security—To view this statement in the configuration.

Output Fields

Table 1 lists the output fields for the show security alarms command. Output fields are listed in the approximate order in which they appear. Field names might be abbreviated (as shown in parentheses) when no level of output is specified or when the detail keyword is used.

Table 1: show security alarms

Field Name

Field Description

Level of Output

ID

Identification number of the alarm.

All levels

Alarm time

Date and time the alarm was raised..

All levels

Message

Information about the alarm, including the alarm type, username, IP address, and port number.

All levels

Process

System process (For example, login or sshd) and process identification number associated with the alarm.

detail

Severity

Severity level of the alarm.

detail

Sample Output

show security alarms

content_copy zoom_out_map
[3 SECURITY ALARMS] user@router> show security alarms

ID    Alarm time               Message
1     2010-01-19 13:41:36 PST  SSHD_LOGIN_FAILED_LIMIT: Specified number of login failures (1) for user 'user' reached from '203.0.113.2’
2     2010-01-19 13:41:52 PST  SSHD_LOGIN_FAILED_LIMIT: Specified number of login failures (1) for user 'user' reached from '203.0.113.2’
3     2010-01-19 13:42:13 PST  SSHD_LOGIN_FAILED_LIMIT: Specified number of login failures (1) for user 'user' reached from '203.0.113.2’

show security alarms detail

content_copy zoom_out_map
[3 SECURITY ALARMS] user@router> show security alarms detail

Alarm ID   : 1
Alarm Type : authentication
Time       : 2010-01-19 13:41:36 PST
Message    : SSHD_LOGIN_FAILED_LIMIT: Specified number of login failures (1) for user 'user' reached from '203.0.113.2’
Process    : sshd (pid 1414)
Severity   : notice

Alarm ID   : 2
Alarm Type : authentication
Time       : 2010-01-19 13:41:52 PST
Message    : SSHD_LOGIN_FAILED_LIMIT: Specified number of login failures (1) for user 'user' reached from '203.0.113.2’
Process    : sshd (pid 1414)
Severity   : notice

Alarm ID   : 3
Alarm Type : authentication
Time       : 2010-01-19 13:42:13 PST
Message    : SSHD_LOGIN_FAILED_LIMIT: Specified number of login failures (1) for user 'user' reached from '203.0.113.2’
Process    : sshd (pid 1414)
Severity   : notice

show security alarms alarm-id

content_copy zoom_out_map
[3 SECURITY ALARMS] user@router> show security alarms alarm-id 1

ID    Alarm time               Message
1     2010-01-19 13:41:36 PST  SSHD_LOGIN_FAILED_LIMIT: Specified number of login failures (1) for user 'user' reached from '203.0.113.2’

show security alarms alarm-type authentication

content_copy zoom_out_map
[3 SECURITY ALARMS] user@router> show security alarms alarm-type authentication

ID    Alarm time               Message
1     2010-01-19 13:41:36 PST  SSHD_LOGIN_FAILED_LIMIT: Specified number of login failures (1) for user 'user' reached from '203.0.113.2’
2     2010-01-19 13:41:52 PST  SSHD_LOGIN_FAILED_LIMIT: Specified number of login failures (1) for user 'user' reached from '203.0.113.2’
3     2010-01-19 13:42:13 PST  SSHD_LOGIN_FAILED_LIMIT: Specified number of login failures (1) for user 'user' reached from '203.0.113.2’

show security alarms newer-than <time>

content_copy zoom_out_map
[3 SECURITY ALARMS] user@router> show security alarms newer-than 2010-01-19.13:41:59

3     2010-01-19 13:42:13 PST  SSHD_LOGIN_FAILED_LIMIT: Specified number of login failures (1) for user 'user' reached from '203.0.113.2’

show security alarms older-than <time>

content_copy zoom_out_map
[3 SECURITY ALARMS] user@router> show security alarms older-than 2010-01-19.13:41:59 

ID    Alarm time               Message
1     2010-01-19 13:41:36 PST  SSHD_LOGIN_FAILED_LIMIT: Specified number of login failures (1) for user 'user' reached from '203.0.113.2’
2     2010-01-19 13:41:52 PST  SSHD_LOGIN_FAILED_LIMIT: Specified number of login failures (1) for user 'user' reached from '203.0.113.2’

show security alarms process <process>

content_copy zoom_out_map
[3 SECURITY ALARMS] user@router> show security alarms process sshd 

ID    Alarm time               Message
1     2010-01-19 13:41:36 PST  SSHD_LOGIN_FAILED_LIMIT: Specified number of login failures (1) for user 'user' reached from '203.0.113.2’
2     2010-01-19 13:41:52 PST  SSHD_LOGIN_FAILED_LIMIT: Specified number of login failures (1) for user 'user' reached from '203.0.113.2’
3     2010-01-19 13:42:13 PST  SSHD_LOGIN_FAILED_LIMIT: Specified number of login failures (1) for user 'user' reached from '203.0.113.2’

show security alarms severity <severity>

content_copy zoom_out_map
[3 SECURITY ALARMS] user@router> show security alarms severity notice 

ID    Alarm time               Message
1     2010-01-19 13:41:36 PST  SSHD_LOGIN_FAILED_LIMIT: Specified number of login failures (1) for user 'user' reached from '203.0.113.2’
2     2010-01-19 13:41:52 PST  SSHD_LOGIN_FAILED_LIMIT: Specified number of login failures (1) for user 'user' reached from '203.0.113.2’
3     2010-01-19 13:42:13 PST  SSHD_LOGIN_FAILED_LIMIT: Specified number of login failures (1) for user 'user' reached from '203.0.113.2’

Release Information

Command introduced in Junos OS Release 11.2.

footer-navigation