show security log report in-detail
Syntax
show security log report in-detail {all | atp | dns | idp | ipsec-vpn | screen | session | threat | utm}
Description
This command allows you to generate detail log content.
Options
| all |
Display all audit event logs stored in the device memory. |
| atp |
Display all ATP event logs. |
| dns |
Display all DNS event logs. |
| idp |
Display all IDP event logs. |
| ipsec-vpn |
Display all IPsec-VPN event logs. |
| screen |
Display all sceen event logs. |
| session |
Display all session logs. |
| threat |
Display all threat related logs. |
| Content Security |
Display all Content Security event logs. |
Required Privilege Level
view
Output Fields
Table 1 lists the output fields for the show
security log report in-detail command.
|
Field Name |
Field Description |
|---|---|
|
|
The timestamp when the security event was received. |
|
|
The message describing the security event. |
Sample Output
- show security log report in-detail
- show security log report in-detail dns
- show security log report in-detail threat
- show security log report in-detail all expression
show security log report in-detail
user@host> show security log report in-detail all <14>1 2023-01-13T07:40:06 host RT_LOG_SELF_TEST - IDP_ATTACK_LOG_EVENT [message-type="0" policy-name="policy_5_7_5" repeat-count="0" elapsed-time="0" source-interface-name="ge-4/1/7.0" destination-interface-name="ge-4/3/7.0" packet-log-id="0" xff-header="-" source-address="192.0.2.0/24" destination-address="198.51.100.0/24" application-name="TELNET" username="NONE" rule-name="r15" action="action15" threat-severity="Critical" attack-name="attack15" cve-id="CVE-2014-0160" session-id="1" source-zone-name="Fake src zone" destination-zone-name="Fake dst zone" source-port="16384" destination-port="32768" protocol-name="TCP"] <14>1 2023-01-13T07:40:06 host RT_LOG_SELF_TEST - IDP_ATTACK_LOG_EVENT [message-type="0" policy-name="policy_5_7_5" repeat-count="0" elapsed-time="0" source-interface-name="ge-4/1/7.0" destination-interface-name="ge-4/3/7.0" packet-log-id="0" xff-header="-" source-address="192.0.2.0/24" destination-address="198.51.100.0/24" application-name="TELNET" username="NONE" rule-name="r15" action="action15" threat-severity="Critical" attack-name="attack15" cve-id="CVE-2014-0160" session-id="1" source-zone-name="Fake src zone" destination-zone-name="Fake dst zone" source-port="16384" destination-port="32768" protocol-name="TCP"] <14>1 2023-01-23T00:41:36 host RT_LOG_SELF_TEST - RT_FLOW_SESSION_CLOSE [nat-source-address="192.168.7.0/24" nat-source-port="31000" nat-destination-address="235.13.2.1/24" nat-destination-port="32768" packets-from-client="4294967295" application="Fake application" session-flag="0" source-address="192.0.2.2/24" destination-address="198.51.100.2/24" nested-application="ANSWERS" username="Lex" policy-name="Fake policy" bytes-from-server="4294967292" packets-from-server="4294967294" bytes-from-client="4294967293" packet-incoming-interface="Fake packet incoming if" source-zone-name="Fake src zone" destination-zone-name="Fake dst zone" session-id="1" source-port="16384" destination-port="32768" protocol-id="UDP" elapsed-time="88888888" reason="Test reason"] <14>1 2023-02-26T23:15:52 host RT_LOG_SELF_TEST - ANTISPAM_SPAM_DETECTED_MT [action="BLOCKED" source-address="192.0.2.1/24" source-name=spamtest@spamtest.com username="192.0.2.1/24" reason="TESTSPAM" profile-name="PROFILE" session-id="1" source-zone-name="src-zone" destination-zone-name="dst-zone"] <12>1 2023-02-26T23:15:52 host RT_LOG_SELF_TEST - AV_VIRUS_DETECTED_MT [action="BLOCKED" source-address="192.0.2.1/24" destination-address="198.51.100.2/24" name="EICAR-Test-File" url=http://www.viruslist.com/en/search?VN=EICAR-Test-File username="192.0.2.1/24" profile-name="PROFILE" session-id="1" filename="Fake file" source-zone-name="src-zone" destination-zone-name="dst-zone" source-port="16384" destination-port="32768"] <12>1 2023-02-26T23:15:52 host RT_LOG_SELF_TEST - WEBFILTER_URL_BLOCKED [application="TEST-APPLICATION" urlcategory-risk="0" source-address="192.0.2.1/24" destination-address="198.51.100.2/24" url=http://www.viruslist.com/en/search?VN=EICAR-Test-File username="192.0.2.1/24" reason="TESTSPAM" profile="PROFILE" category="N/A" session-id="1" nested-application="SQUIRRELMAIL" source-zone-name="src-zone" destination-zone-name="dst-zone" source-port="16384" destination-port="32768"] <14>1 2023-02-26T23:15:52 host RT_LOG_SELF_TEST - WEBFILTER_URL_PERMITTED [application="TEST-APPLICATION" urlcategory-risk="0" source-address="192.0.2.1/24" destination-address="198.51.100.2/24" url=http://www.viruslist.com/en/search?VN=EICAR-Test-File username="192.0.2.1/24" reason="TESTSPAM" profile="PROFILE" category="N/A" session-id="1" nested-application="SQUIRRELMAIL" source-zone-name="src-zone" destination-zone-name="dst-zone" source-port="16384" destination-port="32768"] <14>1 2023-02-26T23:15:52 host RT_LOG_SELF_TEST - CONTENT_FILTERING_BLOCKED_MT [action="BLOCKED" source-address="192.0.2.1/24" destination-address="198.51.100.2/24" username="192.0.2.1/24" reason="TESTSPAM" profile-name="PROFILE" argument="TCP" session-id="1" filename="Fake file" source-zone-name="src-zone" destination-zone-name="dst-zone" source-port="16384" destination-port="32768"] <11>1 2023-02-26T23:15:52 host RT_LOG_SELF_TEST - RT_SCREEN_ICMP [interface-name="test" action="test" source-address="192.0.2.1/24" destination-address="198.51.100.2/24" attack-name="test" source-zone-name="Fake src zone"] <11>1 2023-02-26T23:15:52 host RT_LOG_SELF_TEST - RT_SCREEN_IP [interface-name="test_interface" action="test_action" source-address="192.0.2.1/24" destination-address="198.51.100.2/24" attack-name="test" source-zone-name="Fake src zone" protocol-id="17"] <11>1 2023-02-26T23:15:52 host RT_LOG_SELF_TEST - RT_SCREEN_SESSION_LIMIT [interface-name="test_interface" action="test_action" source-address="192.0.2.1/24" destination-address="198.51.100.2/24" attack-name="test" source-zone-name="Fake src zone" source-port="16384" destination-port="32768" protocol-id="17"] <11>1 2023-02-26T23:15:52 host RT_LOG_SELF_TEST - RT_SCREEN_TCP [interface-name="test_interface" action="test_action" source-address="192.0.2.1/24" destination-address="198.51.100.2/24" attack-name="test" source-zone-name="Fake src zone" source-port="16384" destination-port="32768"] <11>1 2023-02-26T23:15:52 host RT_LOG_SELF_TEST - RT_SCREEN_TCP_DST_IP [interface-name="test_interface" action="test_action" destination-address="198.51.100.2/24" attack-name="test" source-zone-name="Fake src zone"] <11>1 2023-02-26T23:15:52 host RT_LOG_SELF_TEST - RT_SCREEN_TCP_SRC_IP [interface-name="test_interface" action="test_action" source-address="192.0.2.1/24" attack-name="test" source-zone-name="Fake src zone"] <11>1 2023-02-26T23:15:52 host RT_LOG_SELF_TEST - RT_SCREEN_UDP [interface-name="test_interface" action="test_action" source-address="192.0.2.1/24" destination-address="198.51.100.2/24" attack-name="test" source-zone-name="Fake src zone" source-port="16384" destination-port="32768"] <14>1 2023-02-26T23:15:52 host RT_LOG_SELF_TEST - RT_FLOW_SESSION_CREATE [nat-source-address="192.168.7.0/24" nat-source-port="30000" nat-destination-address="235.13.2.1/24" nat-destination-port="32768" application="Fake application" source-address="192.168.7.0/24" destination-address="235.13.2.1/24" nested-application="ANSWERS" username="Fake username" policy-name="Fake policy" packet-incoming-interface="Fake packet incoming if" source-zone-name="Fake src zone" destination-zone-name="Fake dst zone" session-id="1" source-port="16384" destination-port="32768" protocol-id="UDP"] <14>1 2023-02-26T23:15:52 host RT_LOG_SELF_TEST - RT_FLOW_SESSION_CLOSE [nat-source-address="192.168.7.0/24" nat-source-port="30000" nat-destination-address="235.13.2.1/24" nat-destination-port="32768" packets-from-client="4294967295" application="Fake application" session-flag="0" source-address="192.168.7.0/24" destination-address="235.13.2.1/24" nested-application="ANSWERS" username="Fake username" policy-name="Fake policy" bytes-from-server="4294967292" packets-from-server="4294967294" bytes-from-client="4294967293" packet-incoming-interface="Fake packet incoming if" source-zone-name="Fake src zone" destination-zone-name="Fake dst zone" session-id="1" source-port="16384" destination-port="32768" protocol-id="UDP" elapsed-time="88888888" reason="Test reason"] <14>1 2023-02-26T23:15:52 host RT_LOG_SELF_TEST - RT_FLOW_SESSION_DENY [application="Fake application" source-address="192.168.7.0/24" destination-address="235.13.2.1/24" nested-application="ANSWERS" username="Fake username" policy-name="Fake policy" packet-incoming-interface="Fake packet incoming if" source-zone-name="Fake src zone" destination-zone-name="Fake dst zone" session-id="1" source-port="16384" destination-port="32768" protocol-id="UDP" reason="Test reason"] <11>1 2023-02-26T23:15:52 host RT_LOG_SELF_TEST - RT_IPSEC_BAD_SPI [interface-name="Fake interface" tunnel-id="1" length="1024" type="Fake_Type" index="1010" sequence-number="4000" source-address="192.168.7.0/24" destination-address="235.13.2.1/24"] <11>1 2023-02-26T23:15:52 host RT_LOG_SELF_TEST - RT_IPSEC_REPLAY [interface-name="Fake interface" tunnel-id="1" length="1024" type="Fake_Type" index="1010" sequence-number="4000" source-address="192.168.7.0/24" destination-address="235.13.2.1/24"] <11>1 2023-02-26T23:15:52 host RT_LOG_SELF_TEST - RT_IPSEC_PV_REPLAY [interface-name="Fake interface" tunnel-id="1" length="1024" type="Fake_Type" index="1010" sequence-number="4000" source-address="192.168.7.0/24" destination-address="235.13.2.1/24"] <8>1 2023-02-26T23:15:52 host RT_LOG_SELF_TEST - RT_IPSEC_D3P_ERR [tunnel-id="1" length="1024" type="Fake_Type" index="1010" D3P error="Fake error" source-address="192.168.7.0/24" destination-address="235.13.2.1/24"] <11>1 2023-02-26T23:15:52 host RT_LOG_SELF_TEST - RT_IPSEC_DECRYPT_BAD_PAD [tunnel-id="1" index="1010" source-address="192.168.7.0/24" destination-address="235.13.2.1/24"] <11>1 2023-02-26T23:15:52 host RT_LOG_SELF_TEST - RT_IPSEC_PV_SYM_KEYGEN [error-message="Fake error"] <11>1 2023-02-26T23:15:52 host RT_LOG_SELF_TEST - RT_IPSEC_AUTH_FAIL [error-message="Fake error"] <11>1 2023-02-26T23:15:52 host RT_LOG_SELF_TEST - RT_IPSEC_PV_ENCRYPTION [error-message="Fake error"] <11>1 2023-02-26T23:15:52 host RT_LOG_SELF_TEST - RT_IPSEC_PV_DECRYPTION [error-message="Fake error"] <14>1 2023-02-26T23:15:52 host RT_LOG_SELF_TEST - IDP_ATTACK_LOG_EVENT [message-type="0" policy-name="policy_5_7_5" repeat-count="0" elapsed-time="0" source-interface-name="ge-4/1/7.0" destination-interface-name="ge-4/3/7.0" packet-log-id="0" xff-header="-" source-address="192.0.2.1/24" destination-address="198.51.100.2/24" application-name="TELNET" username="NONE" rule-name="1" action="TRAFFIC_IPACTION_NOTIFY" threat-severity="INFO" attack-name="-" cve-id="CVE-2014-0160" session-id="1" source-zone-name="Fake src zone" destination-zone-name="Fake dst zone" source-port="16384" destination-port="32768" protocol-name="TCP"] <14>1 2023-02-26T23:15:52 host RT_LOG_SELF_TEST - SECINTEL_ACTION_LOG [http-host="test" application="test" feed-name="test" policy-name="test" profile-name="test" occur-count="3" source-address="192.0.2.1/24" destination-address="198.51.100.2/24" threat-severity="5" sub-category="CC" action="block" session-id="1" username="Fake username" nested-application="ANSWERS" source-zone-name="Fake src zone" destination-zone-name="Fake dst zone" source-port="16384" destination-port="32768" protocol-id="17"] <14>1 2023-02-26T23:15:52 host RT_LOG_SELF_TEST - AAMW_ACTION_LOG [hostname="test" list-hit="test" file-hash-lookup="test" application="test" policy-name="test" source-address="192.0.2.1/24" destination-address="198.51.100.2/24" verdict-number="5" file-category="virus" malware-info="Test-File" action="block" file-name="test_name" url=www.test.com session-id="1" username="Fake username" nested-application="ANSWERS" source-zone-name="Fake src zone" destination-zone-name="Fake dst zone" source-port="16384" destination-port="32768" protocol-id="17" sample-sha256="da26ba1e13ce4702bd5154789ce1a699ba206c12021d9823380febd795f5b002"] <14>1 2023-02-26T23:15:52 host RT_LOG_SELF_TEST - AAMW_MALWARE_EVENT_LOG [timestamp="fake-time" tenant-id="test" hostname="test" source-address="192.0.2.1/24" verdict-number="5" malware-info="Test-File" url=www.test.com session-id="1" username="Fake username" sample-sha256="da26ba1e13ce4702bd5154789ce1a699ba206c12021d9823380febd795f5b002"] <14>1 2023-02-26T23:15:52 host RT_LOG_SELF_TEST - AAMW_SMTP_ACTION_LOG [list-hit="test" application="test" policy-name="test" source-address="192.0.2.1/24" destination-address="198.51.100.2/24" verdict-number="5" file-category="virus" malware-info="Test-File" action="block" file-name="test_name" session-id="1" username="Fake username" nested-application="ANSWERS" source-zone-name="Fake src zone" destination-zone-name="Fake dst zone" source-port="16384" destination-port="32768" protocol-id="17" send-from=send_from_selftest@email.com send-to=send_to_selftest@email.com sample-sha256="da26ba1e13ce4702bd5154789ce1a699ba206c12021d9823380febd795f5b002"] <14>1 2023-02-26T23:15:52 host RT_LOG_SELF_TEST - AAMW_IMAP_ACTION_LOG [list-hit="test" application="test" policy-name="test" source-address="192.0.2.1/24" destination-address="198.51.100.2/24" verdict-number="5" file-category="virus" malware-info="Test-File" action="block" file-name="test_name" session-id="1" username="Fake username" nested-application="ANSWERS" source-zone-name="Fake src zone" destination-zone-name="Fake dst zone" source-port="16384" destination-port="32768" protocol-id="17" send-from=send_from_selftest@email.com send-to=send_to_selftest@email.com sample-sha256="da26ba1e13ce4702bd5154789ce1a699ba206c12021d9823380febd795f5b002"]
show security log report in-detail dns
user@host> show security log report in-detail dns <14>1 2022-08-22T00:37:34 host RT_LOG_SELF_TEST - SMS_FALLBACK_EVENT [application="test" query-type="test" source-address="192.0.2.1/24" destination-address="198.51.100.2/24" query="test" action="test" source-port="36733" destination-port="80" protocol-id="unkn" policy-name="test" username="test" session-id="1" source-zone-name="test" destination-zone-name="test" nested-application="DNS" dns-model="test" reason="test"]
show security log report in-detail threat
user@host> show security log report in-detail threat <14>1 2022-08-22T00:37:34 host RT_LOG_SELF_TEST - SMS_FALLBACK_EVENT [application="test" query-type="test" source-address="192.0.2.1/24" destination-address="198.51.100.2/24" query="test" action="test" source-port="36733" destination-port="80" protocol-id="unkn" policy-name="test" username="test" session-id="1" source-zone-name="test" destination-zone-name="test" nested-application="DNS" dns-model="test" reason="test"]
show security log report in-detail all expression
user@host> show security log report in-detail all expression ( source-address=192.0.3.2/24 && ( session-id=785 || session-id=786 )) <14>1 2022-06-15T05:04:35 10.49.18.230 RT_FLOW - RT_FLOW_SESSION_CREATE [nat-source-address="192.0.3.3/24" nat-source-port="47452" nat-destination-address="198.51.100.3/24 nat-destination-port="80" protocol-id="6" application="HTTP" source-address="192.0.3.2/24" destination-address="198.51.100.3/24" nested-application="BING" username="192.0.3.2/24" policy-name="policy1" packet-incoming-interface="ge-0/0/0.0" source-zone-name="trust" destination-zone-name="untrust" session-id="785" source-port="0" destination-port="0"] <14>1 2022-06-15T05:04:59 10.49.18.230 RT_FLOW - RT_FLOW_SESSION_CLOSE [reason="TCP FIN" nat-source-address="192.0.3.3/24" nat-source-port="47452" nat-destination-address="198.51.100.3/24" nat-destination-port="80" protocol-id="6" packets-from-client="15840" elapsed-time="24" application="HTTP" session-flag="0" source-address="192.0.3.2/24" destination-address="198.51.100.3/24" nested-application="BING" username="192.0.3.2/24" policy-name="policy1" bytes-from-server="218102537" packets-from-server="157892" bytes-from-client="828078" packet-incoming-interface="ge-0/0/0.0" source-zone-name="trust" destination-zone-name="untrust" session-id="785" source-port="0" destination-port="0"]
Release Information
Command introduced in Junos OS Release 23.1R1 .