log (Security)
Syntax
log {
(source-address source-address | source-interface source-interface);
cache {
exclude name {
destination-address destination-address;
destination-port destination-port;
event-id event-id;
failure;
interface-name interface-name;
policy-name policy-name;
process process;
protocol protocol;
source-address source-address;
source-port source-port;
success;
username username;
}
limit limit;
}
disable;
escape;
time-format (year | millisecond);
event-rate logs per second;
facility-override (authorization | daemon | ftp | kernel | local0 | local1 | local2 | local3 | local4 | local5 | local6 | local7 | user);
file {
files files;
name name;
path path;
size size;
}
format (binary | protobuf | sd-syslog | syslog);
max-database-record max-database-record;
message-rate-limit messages per second;
mode (event | stream | stream-event);
rate-cap logs per second;
report {
logs-per-table {
idp idp;
ipsec-vpn ipsec-vpn;
screen screen;
session-all session-all;
sky sky;
utm utm;
}
table-lifetime table-lifetime;
table-mode {
dense;
}
}
retry-count retry-count;
root-streaming;
stream stream-name {
category (all | content-security | fw-auth | screen | alg | nat | flow | sctp | gtp | ipsec | idp | rtlog |pst-ds-lite | appqos |secintel |aamw);
filter {
threat-attack;
}
format (binary | protobuf | sd-syslog | syslog | welf);
host {
ip-address;
port port-number;
routing-instanceinstance-name;
}
radius {
ipaddr {
backup backup;
primary primary;
}
port port number;
secret secret;
}
rate-limit {
log-rate;
}
severity (alert | critical | debug | emergency | error | info | notice | warning);
source-address {
ip-address;
}
time-format (year | millisecond);
transport {
protocol (tcp | tls | udp);
tcp-connections tcp-connections;
tls-profile tls-profile;
}
}
traceoptions {
file <filename> <files files> <match match> <size size> <(world-readable | no-world-readable)>;
flag name;
no-remote-trace;
}
transport {
protocol (tcp | tls | udp);
tcp-connections tcp-connections;
tls-profile tls-profile;
}
utc-timestamp;
}
Hierarchy Level
[edit security] [editlogical-systemsname security] [edittenantstenant-name security]
Description
Configure security log. Set the mode of logging (event for traditional system logging or stream for streaming security logs through a revenue port to a server). You can also specify all the other parameters for security logging.
Options
cache |
Cache security log events in the audit log buffer. |
disable |
Disable the security logging for the device. |
escape |
Escapes
the stream log forwarding to avoid parsing errors. Stream mode supports
escape in |
time-format |
Specify the year, the millisecond, or both in the timestamp. |
event-rate rate |
Limit the rate at which logs are streamed per second.
|
facility-override |
Alternate facility for logging to remote host. |
file |
Specify the security log file options for logs in binary format.
|
format |
Set the security log format for the device. |
max-database-record |
The following are the disk usage range limits for the database:
|
mode |
Control how security logs are processed and exported. |
rate-cap rate-cap-value |
Work with event mode only. This option limits the rate at which data plane logs are generated per second.
|
retry-countretry-count |
Specify the maximum number attempts to send accounting message to the RADIUS accounting server in case of a transmission failure. |
| root-streaming | Allows the user logical systems to generate the logs using the root logical system's stream configuration. |
source-address source-address |
Specify a source IP address or IP address used when exporting security logs, which is mandatory to configure stream host. |
source-interface interface-name |
Specify a source interface name, which is mandatory to configure stream host. The |
stream |
Every stream can configure file or host. |
traceoptions |
Specify security log daemon trace options. |
transport |
Set security log transport settings. |
utc-timestamp |
Specify to use UTC time for security log timestamps. |
The remaining statements are explained separately. See CLI Explorer.
Required Privilege Level
security—To view this statement in the configuration.
security-control—To add this statement to the configuration.
Release Information
Statement introduced in Junos OS Release 9.2.
The [edit logical-systems name security] and [edit tenants tenant-name security] hierarchy levels introduced
in Junos OS Release 19.1R1.
escape option added in Junos OS Release 20.2R1.
root-streaming option added in Junos OS Release 20.3R1.
protobuf option is introduced in Junos OS Release 23.2R1.
retry-count option is introduced in Junos OS Release 24.2R1.