Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

header-navigation
keyboard_arrow_up
close
keyboard_arrow_left
Junos CLI Reference
Table of Contents Expand all
list Table of Contents
file_download PDF
{ "lLangCode": "en", "lName": "English", "lCountryCode": "us", "transcode": "en_US" }
English
keyboard_arrow_right

show security log file

date_range 19-Nov-23

Syntax

content_copy zoom_out_map
show security log file

Description

Enables you to view event-mode log files stored on the device in binary and protobuf format.

Required Privilege Level

view

Output Fields

Table 1 lists the output fields for the show security log file command. Output fields are listed in the approximate order in which they appear.

Table 1: show security log file Output Fields

Field Name

Field Description

Event time

The timestamp when the security event was received.

Message

The message describing the security event.

Sample Output

show security log file

content_copy zoom_out_map
user@host> show security log file

<14>1 2011-08-28T21:14:43 topstar RT_FLOW - RT_FLOW_SESSION_CREATE [junos@2636.1.1.1.2.34 source-address="7.7.7.2" source-port="1" destination-address="8.8.8.2" destination-port="5636" service-name="icmp" nat-source-address="7.7.7.2" nat-source-port="1" nat-destination-address="8.8.8.2" nat-destination-port="5636" src-nat-rule-name="None" dst-nat-rule-name="None" protocol-id="1" policy-name="client-to-server" source-zone-name="client" destination-zone-name="server" session-id-32="60000442" username="N/A" roles="N/A" packet-incoming-interface="ge-0/0/0.0"]

<14>1 2011-08-28T21:14:45 topstar RT_FLOW - RT_FLOW_SESSION_CLOSE [junos@2636.1.1.1.2.34 reason="response received" source-address="7.7.7.2" source-port="0" destination-address="8.8.8.2" destination-port="5636" service-name="icmp" nat-source-address="7.7.7.2" nat-source-port="0" nat-destination-address="8.8.8.2" nat-destination-port="5636" src-nat-rule-name="None" dst-nat-rule-name="None" protocol-id="1" policy-name="client-to-server" source-zone-name="client" destination-zone-name="server" session-id-32="60000441" packets-from-client="1" bytes-from-client="84" packets-from-server="1" bytes-from-server="84" elapsed-time="3" application="UNKNOWN" nested-application="UNKNOWN" username="N/A" roles="N/A" packet-incoming-interface="ge-0/0/0.0"]

...

user@host> show security log file

<14>1 2011-11-17T23:41:46 topstar RT_FLOW - RT_FLOW_SESSION_CREATE_LS [junos@2636.1.1.1.2.34 logical-system-name="LSYS1" source-address="3001::2" source-port="0" destination-address="5001::2" destination-port="17420" service-name="icmpv6" nat-source-address="3001::2" nat-source-port="0" nat-destination-address="5001::2" nat-destination-port="17420" src-nat-rule-name="None" dst-nat-rule-name="None" protocol-id="58" policy-name="lsys1trust-to-lsys1trust" source-zone-name="lsys1-trust" destination-zone-name="lsys1-trust" session-id-32="60000218" username="N/A" roles="N/A" packet-incoming-interface="ge-0/0/2.0"]


<14>1 2011-11-17T23:41:48 topstar RT_FLOW - RT_FLOW_SESSION_CLOSE [junos@2636.1.1.1.2.34 reason="response received" source-address="3001::2" source-port="0" destination-address="5001::2" destination-port="17420" service-name="icmpv6" nat-source-address="3001::2" nat-source-port="0" nat-destination-address="5001::2" nat-destination-port="17420" src-nat-rule-name="None" dst-nat-rule-name="None" protocol-id="58" policy-name="lsys1trust-to-lsys1trust" source-zone-name="lsys1-trust" destination-zone-name="lsys1-trust" session-id-32="60000218" packets-from-client="1" bytes-from-client="104" packets-from-server="1" bytes-from-server="104" elapsed-time="3" application="UNKNOWN" nested-application="UNKNOWN" username="N/A" roles="N/A" packet-incoming-interface="ge-0/0/2.0" encrypted="No "]


<14>1 2011-11-17T23:41:48 topstar RT_FLOW - RT_FLOW_SESSION_CLOSE_LS [junos@2636.1.1.1.2.34 logical-system-name="LSYS1" reason="response received" source-address="3001::2" source-port="0" destination-address="5001::2" destination-port="17420" service-name="icmpv6" nat-source-address="3001::2" nat-source-port="0" nat-destination-address="5001::2" nat-destination-port="17420" src-nat-rule-name="None" dst-nat-rule-name="None" protocol-id="58" policy-name="lsys1trust-to-lsys1trust" source-zone-name="lsys1-trust" destination-zone-name="lsys1-trust" session-id-32="60000218" packets-from-client="1" bytes-from-client="104" packets-from-server="1" bytes-from-server="104" elapsed-time="3" application="UNKNOWN" nested-application="UNKNOWN" username="N/A" roles="N/A" packet-incoming-interface="ge-0/0/2.0" encrypted="No "]

 ...

user@host>show security log file bin_msg

<14>1 2011-11-17T23:41:46 topstar RT_FLOW - RT_FLOW_SESSION_CREATE_LS [junos@2636.1.1.1.2.34 logical-system-name="LSYS1" source-address="3001::2" source-port="0" destination-address="5001::2" destination-port="17420" service-name="icmpv6" nat-source-address="3001::2" nat-source-port="0" nat-destination-address="5001::2" nat-destination-port="17420" src-nat-rule-name="None" dst-nat-rule-name="None" protocol-id="58" policy-name="lsys1trust-to-lsys1trust" source-zone-name="lsys1-trust" destination-zone-name="lsys1-trust" session-id-32="60000218" username="N/A" roles="N/A" packet-incoming-interface="ge-0/0/2.0"]


<14>1 2011-11-17T23:41:48 topstar RT_FLOW - RT_FLOW_SESSION_CLOSE [junos@2636.1.1.1.2.34 reason="response received" source-address="3001::2" source-port="0" destination-address="5001::2" destination-port="17420" service-name="icmpv6" nat-source-address="3001::2" nat-source-port="0" nat-destination-address="5001::2" nat-destination-port="17420" src-nat-rule-name="None" dst-nat-rule-name="None" protocol-id="58" policy-name="lsys1trust-to-lsys1trust" source-zone-name="lsys1-trust" destination-zone-name="lsys1-trust" session-id-32="60000218" packets-from-client="1" bytes-from-client="104" packets-from-server="1" bytes-from-server="104" elapsed-time="3" application="UNKNOWN" nested-application="UNKNOWN" username="N/A" roles="N/A" packet-incoming-interface="ge-0/0/2.0" encrypted="No "]


<14>1 2011-11-17T23:41:48 topstar RT_FLOW - RT_FLOW_SESSION_CLOSE_LS [junos@2636.1.1.1.2.34 logical-system-name="LSYS1" reason="response received" source-address="3001::2" source-port="0" destination-address="5001::2" destination-port="17420" service-name="icmpv6" nat-source-address="3001::2" nat-source-port="0" nat-destination-address="5001::2" nat-destination-port="17420" src-nat-rule-name="None" dst-nat-rule-name="None" protocol-id="58" policy-name="lsys1trust-to-lsys1trust" source-zone-name="lsys1-trust" destination-zone-name="lsys1-trust" session-id-32="60000218" packets-from-client="1" bytes-from-client="104" packets-from-server="1" bytes-from-server="104" elapsed-time="3" application="UNKNOWN" nested-application="UNKNOWN" username="N/A" roles="N/A" packet-incoming-interface="ge-0/0/2.0" encrypted="No "]

 ...

user@host>show security log file bin_msg logical-system LSYS1

<14>1 2011-11-17T23:41:46 topstar RT_FLOW - RT_FLOW_SESSION_CREATE_LS [junos@2636.1.1.1.2.34 logical-system-name="LSYS1" source-address="3001::2" source-port="0" destination-address="5001::2" destination-port="17420" service-name="icmpv6" nat-source-address="3001::2" nat-source-port="0" nat-destination-address="5001::2" nat-destination-port="17420" src-nat-rule-name="None" dst-nat-rule-name="None" protocol-id="58" policy-name="lsys1trust-to-lsys1trust" source-zone-name="lsys1-trust" destination-zone-name="lsys1-trust" session-id-32="60000218" username="N/A" roles="N/A" packet-incoming-interface="ge-0/0/2.0"]


<14>1 2011-11-17T23:41:48 topstar RT_FLOW - RT_FLOW_SESSION_CLOSE [junos@2636.1.1.1.2.34 reason="response received" source-address="3001::2" source-port="0" destination-address="5001::2" destination-port="17420" service-name="icmpv6" nat-source-address="3001::2" nat-source-port="0" nat-destination-address="5001::2" nat-destination-port="17420" src-nat-rule-name="None" dst-nat-rule-name="None" protocol-id="58" policy-name="lsys1trust-to-lsys1trust" source-zone-name="lsys1-trust" destination-zone-name="lsys1-trust" session-id-32="60000218" packets-from-client="1" bytes-from-client="104" packets-from-server="1" bytes-from-server="104" elapsed-time="3" application="UNKNOWN" nested-application="UNKNOWN" username="N/A" roles="N/A" packet-incoming-interface="ge-0/0/2.0" encrypted="No "]


<14>1 2011-11-17T23:41:48 topstar RT_FLOW - RT_FLOW_SESSION_CLOSE_LS [junos@2636.1.1.1.2.34 logical-system-name="LSYS1" reason="response received" source-address="3001::2" source-port="0" destination-address="5001::2" destination-port="17420" service-name="icmpv6" nat-source-address="3001::2" nat-source-port="0" nat-destination-address="5001::2" nat-destination-port="17420" src-nat-rule-name="None" dst-nat-rule-name="None" protocol-id="58" policy-name="lsys1trust-to-lsys1trust" source-zone-name="lsys1-trust" destination-zone-name="lsys1-trust" session-id-32="60000218" packets-from-client="1" bytes-from-client="104" packets-from-server="1" bytes-from-server="104" elapsed-time="3" application="UNKNOWN" nested-application="UNKNOWN" username="N/A" roles="N/A" packet-incoming-interface="ge-0/0/2.0" encrypted="No "]

 ...

user@host>show security log file bin_msg tenant TSYS1

<14>1 2011-11-17T23:41:46 topstar RT_FLOW - RT_FLOW_SESSION_CREATE_LS [junos@2636.1.1.1.2.34 logical-system-name="LSYS1" source-address="3001::2" source-port="0" destination-address="5001::2" destination-port="17420" service-name="icmpv6" nat-source-address="3001::2" nat-source-port="0" nat-destination-address="5001::2" nat-destination-port="17420" src-nat-rule-name="None" dst-nat-rule-name="None" protocol-id="58" policy-name="lsys1trust-to-lsys1trust" source-zone-name="lsys1-trust" destination-zone-name="lsys1-trust" session-id-32="60000218" username="N/A" roles="N/A" packet-incoming-interface="ge-0/0/2.0"]


<14>1 2011-11-17T23:41:48 topstar RT_FLOW - RT_FLOW_SESSION_CLOSE [junos@2636.1.1.1.2.34 reason="response received" source-address="3001::2" source-port="0" destination-address="5001::2" destination-port="17420" service-name="icmpv6" nat-source-address="3001::2" nat-source-port="0" nat-destination-address="5001::2" nat-destination-port="17420" src-nat-rule-name="None" dst-nat-rule-name="None" protocol-id="58" policy-name="lsys1trust-to-lsys1trust" source-zone-name="lsys1-trust" destination-zone-name="lsys1-trust" session-id-32="60000218" packets-from-client="1" bytes-from-client="104" packets-from-server="1" bytes-from-server="104" elapsed-time="3" application="UNKNOWN" nested-application="UNKNOWN" username="N/A" roles="N/A" packet-incoming-interface="ge-0/0/2.0" encrypted="No "]


<14>1 2011-11-17T23:41:48 topstar RT_FLOW - RT_FLOW_SESSION_CLOSE_LS [junos@2636.1.1.1.2.34 logical-system-name="LSYS1" reason="response received" source-address="3001::2" source-port="0" destination-address="5001::2" destination-port="17420" service-name="icmpv6" nat-source-address="3001::2" nat-source-port="0" nat-destination-address="5001::2" nat-destination-port="17420" src-nat-rule-name="None" dst-nat-rule-name="None" protocol-id="58" policy-name="lsys1trust-to-lsys1trust" source-zone-name="lsys1-trust" destination-zone-name="lsys1-trust" session-id-32="60000218" packets-from-client="1" bytes-from-client="104" packets-from-server="1" bytes-from-server="104" elapsed-time="3" application="UNKNOWN" nested-application="UNKNOWN" username="N/A" roles="N/A" packet-incoming-interface="ge-0/0/2.0" encrypted="No "]

 ...

user@host>show security log stream file s1_f1

<14>1 2011-11-17T23:41:46 topstar RT_FLOW - RT_FLOW_SESSION_CREATE_LS [junos@2636.1.1.1.2.34 logical-system-name="LSYS1" source-address="3001::2" source-port="0" destination-address="5001::2" destination-port="17420" service-name="icmpv6" nat-source-address="3001::2" nat-source-port="0" nat-destination-address="5001::2" nat-destination-port="17420" src-nat-rule-name="None" dst-nat-rule-name="None" protocol-id="58" policy-name="lsys1trust-to-lsys1trust" source-zone-name="lsys1-trust" destination-zone-name="lsys1-trust" session-id-32="60000218" username="N/A" roles="N/A" packet-incoming-interface="ge-0/0/2.0"]


<14>1 2011-11-17T23:41:48 topstar RT_FLOW - RT_FLOW_SESSION_CLOSE [junos@2636.1.1.1.2.34 reason="response received" source-address="3001::2" source-port="0" destination-address="5001::2" destination-port="17420" service-name="icmpv6" nat-source-address="3001::2" nat-source-port="0" nat-destination-address="5001::2" nat-destination-port="17420" src-nat-rule-name="None" dst-nat-rule-name="None" protocol-id="58" policy-name="lsys1trust-to-lsys1trust" source-zone-name="lsys1-trust" destination-zone-name="lsys1-trust" session-id-32="60000218" packets-from-client="1" bytes-from-client="104" packets-from-server="1" bytes-from-server="104" elapsed-time="3" application="UNKNOWN" nested-application="UNKNOWN" username="N/A" roles="N/A" packet-incoming-interface="ge-0/0/2.0" encrypted="No "]


<14>1 2011-11-17T23:41:48 topstar RT_FLOW - RT_FLOW_SESSION_CLOSE_LS [junos@2636.1.1.1.2.34 logical-system-name="LSYS1" reason="response received" source-address="3001::2" source-port="0" destination-address="5001::2" destination-port="17420" service-name="icmpv6" nat-source-address="3001::2" nat-source-port="0" nat-destination-address="5001::2" nat-destination-port="17420" src-nat-rule-name="None" dst-nat-rule-name="None" protocol-id="58" policy-name="lsys1trust-to-lsys1trust" source-zone-name="lsys1-trust" destination-zone-name="lsys1-trust" session-id-32="60000218" packets-from-client="1" bytes-from-client="104" packets-from-server="1" bytes-from-server="104" elapsed-time="3" application="UNKNOWN" nested-application="UNKNOWN" username="N/A" roles="N/A" packet-incoming-interface="ge-0/0/2.0" encrypted="No "]

 ...

user@host>show security log stream file s1_f1 logical-system LSYS1

<14>1 2011-11-17T23:41:46 topstar RT_FLOW - RT_FLOW_SESSION_CREATE_LS [junos@2636.1.1.1.2.34 logical-system-name="LSYS1" source-address="3001::2" source-port="0" destination-address="5001::2" destination-port="17420" service-name="icmpv6" nat-source-address="3001::2" nat-source-port="0" nat-destination-address="5001::2" nat-destination-port="17420" src-nat-rule-name="None" dst-nat-rule-name="None" protocol-id="58" policy-name="lsys1trust-to-lsys1trust" source-zone-name="lsys1-trust" destination-zone-name="lsys1-trust" session-id-32="60000218" username="N/A" roles="N/A" packet-incoming-interface="ge-0/0/2.0"]


<14>1 2011-11-17T23:41:48 topstar RT_FLOW - RT_FLOW_SESSION_CLOSE [junos@2636.1.1.1.2.34 reason="response received" source-address="3001::2" source-port="0" destination-address="5001::2" destination-port="17420" service-name="icmpv6" nat-source-address="3001::2" nat-source-port="0" nat-destination-address="5001::2" nat-destination-port="17420" src-nat-rule-name="None" dst-nat-rule-name="None" protocol-id="58" policy-name="lsys1trust-to-lsys1trust" source-zone-name="lsys1-trust" destination-zone-name="lsys1-trust" session-id-32="60000218" packets-from-client="1" bytes-from-client="104" packets-from-server="1" bytes-from-server="104" elapsed-time="3" application="UNKNOWN" nested-application="UNKNOWN" username="N/A" roles="N/A" packet-incoming-interface="ge-0/0/2.0" encrypted="No "]


<14>1 2011-11-17T23:41:48 topstar RT_FLOW - RT_FLOW_SESSION_CLOSE_LS [junos@2636.1.1.1.2.34 logical-system-name="LSYS1" reason="response received" source-address="3001::2" source-port="0" destination-address="5001::2" destination-port="17420" service-name="icmpv6" nat-source-address="3001::2" nat-source-port="0" nat-destination-address="5001::2" nat-destination-port="17420" src-nat-rule-name="None" dst-nat-rule-name="None" protocol-id="58" policy-name="lsys1trust-to-lsys1trust" source-zone-name="lsys1-trust" destination-zone-name="lsys1-trust" session-id-32="60000218" packets-from-client="1" bytes-from-client="104" packets-from-server="1" bytes-from-server="104" elapsed-time="3" application="UNKNOWN" nested-application="UNKNOWN" username="N/A" roles="N/A" packet-incoming-interface="ge-0/0/2.0" encrypted="No "]

 ...

user@host>show security log stream file s1_f1 tenant TSYS1

<14>1 2011-11-17T23:41:46 topstar RT_FLOW - RT_FLOW_SESSION_CREATE_LS [junos@2636.1.1.1.2.34 logical-system-name="LSYS1" source-address="3001::2" source-port="0" destination-address="5001::2" destination-port="17420" service-name="icmpv6" nat-source-address="3001::2" nat-source-port="0" nat-destination-address="5001::2" nat-destination-port="17420" src-nat-rule-name="None" dst-nat-rule-name="None" protocol-id="58" policy-name="lsys1trust-to-lsys1trust" source-zone-name="lsys1-trust" destination-zone-name="lsys1-trust" session-id-32="60000218" username="N/A" roles="N/A" packet-incoming-interface="ge-0/0/2.0"]
<14>1 2011-11-17T23:41:48 topstar RT_FLOW - RT_FLOW_SESSION_CLOSE [junos@2636.1.1.1.2.34 reason="response received" source-address="3001::2" source-port="0" destination-address="5001::2" destination-port="17420" service-name="icmpv6" nat-source-address="3001::2" nat-source-port="0" nat-destination-address="5001::2" nat-destination-port="17420" src-nat-rule-name="None" dst-nat-rule-name="None" protocol-id="58" policy-name="lsys1trust-to-lsys1trust" source-zone-name="lsys1-trust" destination-zone-name="lsys1-trust" session-id-32="60000218" packets-from-client="1" bytes-from-client="104" packets-from-server="1" bytes-from-server="104" elapsed-time="3" application="UNKNOWN" nested-application="UNKNOWN" username="N/A" roles="N/A" packet-incoming-interface="ge-0/0/2.0" encrypted="No "]


<14>1 2011-11-17T23:41:48 topstar RT_FLOW - RT_FLOW_SESSION_CLOSE_LS [junos@2636.1.1.1.2.34 logical-system-name="LSYS1" reason="response received" source-address="3001::2" source-port="0" destination-address="5001::2" destination-port="17420" service-name="icmpv6" nat-source-address="3001::2" nat-source-port="0" nat-destination-address="5001::2" nat-destination-port="17420" src-nat-rule-name="None" dst-nat-rule-name="None" protocol-id="58" policy-name="lsys1trust-to-lsys1trust" source-zone-name="lsys1-trust" destination-zone-name="lsys1-trust" session-id-32="60000218" packets-from-client="1" bytes-from-client="104" packets-from-server="1" bytes-from-server="104" elapsed-time="3" application="UNKNOWN" nested-application="UNKNOWN" username="N/A" roles="N/A" packet-incoming-interface="ge-0/0/2.0" encrypted="No "]
 ...

show security log file test1.pb

content_copy zoom_out_map
user@host> show security log file test1.pb
<14>1 2023-03-17T00:06:55 10.53.78.91 RT_LOG_SELF_TEST - SECINTEL_ACTION_LOG [junos@2636.1.1.1.2.129 category="secintel" sub-category="CC" action="block" action-detail="test" http-host="test" threat-severity="5" source-address="1.16.16.16" source-port="16384" destination-address="2.16.16.16" destination-port="32768" protocol-id="17" application="test" nested-application="test" feed-name="test" policy-name="test" profile-name="test" username="Fake username" roles="test" session-id="1" source-zone-name="Fake src zone" destination-zone-name="Fake dst zone" occur-count="3"]
<14>1 2023-03-17T00:06:55 10.53.78.91 RT_LOG_SELF_TEST - AAMW_ACTION_LOG [junos@2636.1.1.1.2.129 hostname="test" file-category="virus" verdict-number="5" malware-info="Test-File" action="block" list-hit="test" file-hash-lookup="test" source-address="1.16.16.16" source-port="16384" destination-address="2.16.16.16" destination-port="32768" protocol-id="17" application="test" nested-application="test" policy-name="test" username="Fake username" roles="test" session-id="1" source-zone-name="Fake src zone" destination-zone-name="Fake dst zone" sample-sha256="da26ba1e13ce4702bd5154789ce1a699ba206c12021d9823380febd795f5b002" file-name="test_name" url="www.test.com"]
<14>1 2023-03-17T00:06:55 10.53.78.91 RT_LOG_SELF_TEST - AAMW_MALWARE_EVENT_LOG [junos@2636.1.1.1.2.129 timestamp="fake-time" tenant-id="test" sample-sha256="da26ba1e13ce4702bd5154789ce1a699ba206c12021d9823380febd795f5b002" source-address="1.16.16.16" verdict-number="5" malware-info="Test-File" username="Fake username" hostname="test" session-id="1" url="www.test.com"]
...

Release Information

Command introduced in Junos OS Release 12.1.

footer-navigation