close

keyboard_arrow_left

Table of Contents Expand all

list Table of Contents

English

show security log

date_range 19-Nov-23

arrow_backward

arrow_forward

Syntax

content_copy zoom_out_map
show security log {all| destination-address| destination-port| event-id| failure|interface-name| newer-than| older-than| process| protocol|report| severity| sort-by| source-address| source-port| success| user}

Description

Display security event logs. This command continuously displays security events on the screen. To stop the display, press Ctrl+c.

Options

all	Display all audit event logs stored in the device memory.
destination-address	Display audit event logs with the specified destination address.
destination-port	Display audit event logs with the specified destination port.
event-id	Display audit event logs with the specified event identification number.
failure	Display failed audit event logs.
file	Display security logs in binary format.
interface-name	Display audit event logs with the specified interface.
newer-than	Display audit event logs newer than the specified date and time.
older-than	Display audit event logs older than the specified date and time.
process	Display audit event logs with the specified process that generated the event.
profile	Display security log profile information.
protocol	Display audit event logs generated through the specified protocol.
query	Query logs from database.
report	Display on-box reports for system traffic logs.
severity	Display audit event logs generated with the specified severity.
sort-by	Display audit event logs generated sorted with the specified options.
source-address	Display audit event logs with the specified source address.
source-port	Display audit event logs with the specified source port.
stream	Display security logs stream information.
success	Display successful audit event logs.
username	Display audit event logs generated for the specified user.

Required Privilege Level

view

Output Fields

Table 1 lists the output fields for the show security log command. Output fields are listed in the approximate order in which they appear.

Table 1: show security log Output Fields
Field Name	Field Description
`Event time`	The timestamp of the events received. Security logs were always timestamped using the UTC time zone by running `set system time-zone utc` and `set security log utc-timestamp` CLI commands. Now, time zone can be defined using the local time zone by running the `set system time-zone time-zone` command to specify the local time zone that the system should use when timestamping the security logs.
`Message`	Security events are listed.

Sample Output

show security log

content_copy zoom_out_map
user@host> show security log
Event time               Message
2010-10-22 13:28:37 CST  session created 1.1.1.2/1-->2.2.2.2/1308 
 icmp 1.1.1.2/1-->2.2.2.2/1308
 None None 1 policy1 trustZone untrustZone 52 N/A(N/A) ge-0/0/1.0
2010-10-22 13:28:38 CST  session created 1.1.1.2/1-->2.2.2.2/1308 icmp 1.1.1.2/1-->2.2.2.2/1308 None None 1 policy1 trustZone untrustZone 54 N/A(N/A) ge-0/0/1.0

...
2010-10-22 13:36:12 CST  session denied m icmp 1(8) policy1 trustZone untrustZone N/A(N/A) ge-0/0/1.0
2010-10-22 13:36:14 CST  session denied 1.1.1.2/2-->2.2.2.2/54812  icmp 1(8) policy1 trustZone untrustZone N/A(N/A) ge-0/0/1.0

...
2010-10-27 15:50:11 CST  IP spoofing! source: 2.2.2.20, destination: 2.2.2.2, protocol-id: 17, zone name: trustZone, interface name: ge-0/0/1.0, action: drop
2010-10-27 15:50:11 CST  IP spoofing! source: source: 2.2.2.20, destination: 2.2.2.2, protocol-id: 17, zone name: trustZone, interface name: ge-0/0/1.0, action: drop

...
2011-02-18 15:53:34 CST  PKID_PV_OBJECT_READ: A PKI object was read into memory from /var/db/certs/common/certification-authority/ca-profile1-ca1.cert
2011-02-18 15:53:35 CST  PKID_PV_OBJECT_READ: A PKI object was read into memory from /var/db/certs/common/crl/ca-profile1.crl
2011-02-18 15:53:35 CST  PKID_PV_OBJECT_READ: A PKI object was read into memory from /var/db/certs/system-key-pair/system-generated.priv
2011-02-18 15:53:35 CST  PKID_PV_OBJECT_READ: A PKI object was read into memory from /var/db/certs/system-cert/system-generated.cert
2011-02-18 15:53:35 CST  PKID_PV_OBJECT_READ: A PKI object was read into memory from /var/db/certs/common/key-pair/cert1.priv
2011-02-18 15:53:42 CST  PKID_PV_OBJECT_READ: A PKI object was read into memory from /var/db/certs/common/key-pair/test2.priv

...
2011-03-14 23:00:40 PDT  IDP_COMMIT_COMPLETED: IDP policy commit is complete.
                         IDP_POLICY_LOAD_FAILED: IDP policy loading failed ;poli
cy[/var/db/idpd/bins/.bin.gz.v], detector[/usr/libdata/libidp-detector.so.tgz.v]
 ,failure detail[Policy loading failed :: Policy file not found
2011-03-14 23:00:58 PDT  ]
                         IDP_POLICY_LOAD_FAILED: IDP policy loading failed ;poli
cy[/var/db/idpd/bins/.bin.gz.v], detector[/usr/libdata/libidp-detector.so.tgz.v]
 ,failure detail[Policy loading failed :: Policy file not found
2011-03-14 23:00:58 PDT  ]
                         IDP_POLICY_LOAD_FAILED: IDP policy loading failed ;poli
cy[/var/db/idpd/bins/.bin.gz.v], detector[/usr/libdata/libidp-detector.so.tgz.v]
 ,failure detail[Policy loading failed :: Policy file not found
2011-03-14 23:00:58 PDT  ]

...
Event time               Message
2011-03-21 14:21:49 CST  UI_CMDLINE_READ_LINE: User 'root', command 'set date ntp 9.9.9.1 source-address 6.6.6.1 '
2011-03-21 14:23:01 CST  UI_CMDLINE_READ_LINE: User 'root', command 'set date ntp 9.9.9.1 source-address 6.6.6.1 .5 '
2011-03-21 14:23:05 CST  KMD_PM_SA_ESTABLISHED: Local gateway: 7.7.7.1, Remote gateway: 8.8.8.1, Local ID: ipv4(any:0,[0..3]=6.6.6.1), Remote ID: ipv4(any:0,[0..3]=9.9.9.1), Direction: inbound, SPI: 37a2a179, AUX-SPI: 0, Mode: tunnel, Type: dynamic 
2011-03-21 14:23:05 CST  KMD_PM_SA_ESTABLISHED: Local gateway: 7.7.7.1, Remote gateway: 8.8.8.1, Local ID: ipv4(any:0,[0..3]=6.6.6.1), Remote ID: ipv4(any:0,[0..3]=9.9.9.1), Direction: outbound, SPI: b2231c1f, AUX-SPI: 0, Mode: tunnel, Type: dynamic 
2011-03-21 14:23:08 CST  UI_CMDLINE_READ_LINE: User 'root', command 'set date ntp 9.9.9.1 source-address 6.6.6.1 '
2011-03-21 14:23:13 CST  UI_CMDLINE_READ_LINE: User 'root', command 'show security log '

Release Information

Command introduced in Junos OS Release 11.2 .

arrow_backward PREVIOUS show security keychain

NEXT arrow_forward show security log file

Junos CLI Reference

ON THIS PAGE

show security log

Syntax

Description

Options

Required Privilege Level

Output Fields

Sample Output

show security log

Release Information

Stay in touch

Helped me install or use the product
Accelerated my deployment

Discuss the product with a co-worker
Make a purchase inquiry

Junos CLI Reference

ON THIS PAGE

show security log

Syntax

Description

Options

Required Privilege Level

Output Fields

Sample Output

show security log

Release Information

Related Documentation

Stay in touch