Overview of System Logging

Junos OS generates system log messages (also called syslog messages) to record events that occur on the device, including the following:

• Routine operations, such as creation of an Open Shortest Path First (OSPF) protocol adjacency or a user login to the configuration database.

• Failure and error conditions, such as failure to access a configuration file or unexpected closure of a connection to a peer process.

• Emergency or critical conditions, such as power-down of the device due to excessive temperature.

Each system log message identifies the Junos OS process responsible for generating the message and provides a brief description of the operation or error that occurred. For detailed information about specific system log messages, see the System Log Explorer.

To configure the device to log system messages, configure the syslog statement at the [edit system] hierarchy level.

Use the System Log Explorer application to view or compare system log messages in different releases.

Starting in Junos OS Release 22.1R1 on SRX Series and NFX Series devices and Junos OS Evolved Release 22.2R1 on QFX5130, QFX5200, QFX5220, and QFX5700 devices, we’ve added multiple events inside the event tag using the <event>UI_LOGIN_EVENT|UI_LOGOUT_EVENT</event> format, which has an option (|) to separate the events and to generate system log messages. Earlier to these releases, the event tag used the <event>UI_LOGIN_EVENT UI_LOGOUT_EVENT</event> format and for various combinations of <get-syslog-events> rpc filters was not getting logged.

Table 1 lists the Junos OS system logging facilities that you can specify in configuration statements at the [edit system syslog] hierarchy level.

Table 2 lists the severity levels that you can specify in configuration statements at the [edit system syslog] hierarchy level. The levels from emergency through info are in the order from highest severity (greatest effect on functioning) to lowest.

Unlike the other severity levels, the none level disables logging of a facility instead of indicating how seriously a triggering event affects routing functions. For more information, see Disabling the System Logging of a Facility.

Table 3 summarizes the default system log settings that apply to all routers that run the Junos OS and specifies which statement to include in the configuration to override the default value.

[edit system syslog]
host hostname {
    facility-override facility;
}

[edit system syslog]
file filename {
    structured-data;
}

[edit system syslog]
archive {
    files number;
}
file filename {
    archive {
        files number;
    }
}

[edit system syslog]
archive {
    size size;
}
file filename {
    archive {
        size size;
    }
}

[edit system syslog]
time-format format;

[edit system syslog]
archive {
    world-readable;
}
file filename {
    archive {
        world-readable;
    }
}

The system log (syslog) client is completely VRF aware. If a server is reachable through a virtual routing and forwarding (VRF) instance, the syslog client can send log messages to the server. To specify the routing instance through which the remote server is reachable, use the routing-instance statement (introduced at appropriate hierarchies).

By default, system logging traffic is sent from the management interface on your device and its associated routing instance. You can configure system logging messages to use the non-default management routing instance mgmt_junos.

• Benefits of the Dedicated Management Instance
• System Logging in the Dedicated Management Instance

The following messages are generated by default on specific routers. To view any of these types of messages, you must configure at least one destination for messages as described in Junos OS Minimum System Logging Configuration.

• To log the kernel process message on an M Series, MX Series, or T Series router, include the kernel info statement at the appropriate hierarchy level:

• On a routing matrix composed of a TX Matrix router and T640 routers, the primary Routing Engine on each T640 router forwards all messages with a severity of info and higher to the primary Routing Engine on the TX Matrix router. This is equivalent to the following configuration statement included on the TX Matrix router:

• Starting in Junos OS Release 15.1X49-D10 and Junos OS Release 17.3R1, likewise on a routing matrix composed of a TX Matrix Plus router with connected T1600 or T4000 routers, the primary Routing Engine on each T1600 or T4000 LCC forwards to the primary Routing Engine on the TX Matrix Plus router all messages with a severity of info and higher. This is equivalent to the following configuration statement included on the TX Matrix Plus router:

  Note:

  From the perspective of the user interface, the routing matrix appears as a single router. The TX Matrix Plus router controls all the T1600 or T4000 routers connected to it in the routing matrix.

The syntax of a standard-format message generated by a Junos OS process or subroutine library depends on whether it includes the below priority informations:

• When the explicit-priority statement is included at the [filename] or [hostname] hierarchy level, a system log message has the following syntax:

• When directed to the console or to users, or when the explicit-priority statement is not included for files or remote hosts, a system log message has the following syntax:

Table 5 describes the message fields.

hostname	process[process-ID]

The syntax of a standard-format message generated by a Junos OS process or subroutine library depends on whether it includes priority information:

• When the explicit-priority statement is included at the [edit system syslog file filename] or [edit system syslog host (hostname | other-routing-engine)] hierarchy level, a system log message has the following syntax

• When directed to the console or to users, or when the explicit-priority statement is not included for files or remote hosts, a system log message has the following syntax:

Table 6 describes the message fields.

Standard-format system log messages generated by services on a PIC, such as the Adaptive Services (AS) PIC, have the following syntax:

Table 7 describes the message fields.

Beginning in Junos OS Release 8.3, when the structured-data statement is included in the configuration for a log file, Junos OS processes and software libraries write messages to the file in structured-data format instead of the standard Junos OS format. For information about the structured-data statement, see Logging Messages in Structured-Data Format.

Structured-format makes it easier for automated applications to extract information from the message. In particular, the standardized format for reporting the value of variables (elements in the English-language message that vary depending on the circumstances that triggered the message) makes it easy for an application to extract those values. In standard format, the variables are interspersed in the message text and not identified as variables.

The structured-data format for a message includes the following fields (which appear here on two lines only for legibility):

Table 8 describes the fields. If the system logging utility cannot determine the value in a particular field, a hyphen ( - ) appears instead.

By default, the structured-data version of a message includes English text at the end, as in the following example (which appears on multiple lines only for legibility):

When the brief statement is included at the [edit system syslog file filename structured-data ] hierarchy level, the English text is omitted, as in this example:

Table 9 maps the codes that appear in the priority-code field to facility and severity level.

Table 10 lists the numerical identifiers for routing platforms that appear in the platform field. The identifier is derived from the platform’s SNMP object identifier (OID) as defined in the Juniper Networks routing platform MIB. For more information about OIDs, see the Network Management and Monitoring Guide.