show security log file
语法
show security log file
描述
允许您查看以二进制和 protobuf 格式存储在设备上的事件模式日志文件。
所需权限级别
视图
输出字段
表 1 列出了命令show security log file的输出字段。输出字段按其出现的大致顺序列出。
字段名称 |
字段说明 |
|---|---|
|
收到安全事件时的时间戳。 |
|
描述安全事件的消息。 |
示例输出
显示安全日志文件
user@host> show security log file <14>1 2011-08-28T21:14:43 topstar RT_FLOW - RT_FLOW_SESSION_CREATE [junos@2636.1.1.1.2.34 source-address="7.7.7.2" source-port="1" destination-address="8.8.8.2" destination-port="5636" service-name="icmp" nat-source-address="7.7.7.2" nat-source-port="1" nat-destination-address="8.8.8.2" nat-destination-port="5636" src-nat-rule-name="None" dst-nat-rule-name="None" protocol-id="1" policy-name="client-to-server" source-zone-name="client" destination-zone-name="server" session-id-32="60000442" username="N/A" roles="N/A" packet-incoming-interface="ge-0/0/0.0"] <14>1 2011-08-28T21:14:45 topstar RT_FLOW - RT_FLOW_SESSION_CLOSE [junos@2636.1.1.1.2.34 reason="response received" source-address="7.7.7.2" source-port="0" destination-address="8.8.8.2" destination-port="5636" service-name="icmp" nat-source-address="7.7.7.2" nat-source-port="0" nat-destination-address="8.8.8.2" nat-destination-port="5636" src-nat-rule-name="None" dst-nat-rule-name="None" protocol-id="1" policy-name="client-to-server" source-zone-name="client" destination-zone-name="server" session-id-32="60000441" packets-from-client="1" bytes-from-client="84" packets-from-server="1" bytes-from-server="84" elapsed-time="3" application="UNKNOWN" nested-application="UNKNOWN" username="N/A" roles="N/A" packet-incoming-interface="ge-0/0/0.0"] ... user@host> show security log file <14>1 2011-11-17T23:41:46 topstar RT_FLOW - RT_FLOW_SESSION_CREATE_LS [junos@2636.1.1.1.2.34 logical-system-name="LSYS1" source-address="3001::2" source-port="0" destination-address="5001::2" destination-port="17420" service-name="icmpv6" nat-source-address="3001::2" nat-source-port="0" nat-destination-address="5001::2" nat-destination-port="17420" src-nat-rule-name="None" dst-nat-rule-name="None" protocol-id="58" policy-name="lsys1trust-to-lsys1trust" source-zone-name="lsys1-trust" destination-zone-name="lsys1-trust" session-id-32="60000218" username="N/A" roles="N/A" packet-incoming-interface="ge-0/0/2.0"] <14>1 2011-11-17T23:41:48 topstar RT_FLOW - RT_FLOW_SESSION_CLOSE [junos@2636.1.1.1.2.34 reason="response received" source-address="3001::2" source-port="0" destination-address="5001::2" destination-port="17420" service-name="icmpv6" nat-source-address="3001::2" nat-source-port="0" nat-destination-address="5001::2" nat-destination-port="17420" src-nat-rule-name="None" dst-nat-rule-name="None" protocol-id="58" policy-name="lsys1trust-to-lsys1trust" source-zone-name="lsys1-trust" destination-zone-name="lsys1-trust" session-id-32="60000218" packets-from-client="1" bytes-from-client="104" packets-from-server="1" bytes-from-server="104" elapsed-time="3" application="UNKNOWN" nested-application="UNKNOWN" username="N/A" roles="N/A" packet-incoming-interface="ge-0/0/2.0" encrypted="No "] <14>1 2011-11-17T23:41:48 topstar RT_FLOW - RT_FLOW_SESSION_CLOSE_LS [junos@2636.1.1.1.2.34 logical-system-name="LSYS1" reason="response received" source-address="3001::2" source-port="0" destination-address="5001::2" destination-port="17420" service-name="icmpv6" nat-source-address="3001::2" nat-source-port="0" nat-destination-address="5001::2" nat-destination-port="17420" src-nat-rule-name="None" dst-nat-rule-name="None" protocol-id="58" policy-name="lsys1trust-to-lsys1trust" source-zone-name="lsys1-trust" destination-zone-name="lsys1-trust" session-id-32="60000218" packets-from-client="1" bytes-from-client="104" packets-from-server="1" bytes-from-server="104" elapsed-time="3" application="UNKNOWN" nested-application="UNKNOWN" username="N/A" roles="N/A" packet-incoming-interface="ge-0/0/2.0" encrypted="No "] ... user@host>show security log file bin_msg <14>1 2011-11-17T23:41:46 topstar RT_FLOW - RT_FLOW_SESSION_CREATE_LS [junos@2636.1.1.1.2.34 logical-system-name="LSYS1" source-address="3001::2" source-port="0" destination-address="5001::2" destination-port="17420" service-name="icmpv6" nat-source-address="3001::2" nat-source-port="0" nat-destination-address="5001::2" nat-destination-port="17420" src-nat-rule-name="None" dst-nat-rule-name="None" protocol-id="58" policy-name="lsys1trust-to-lsys1trust" source-zone-name="lsys1-trust" destination-zone-name="lsys1-trust" session-id-32="60000218" username="N/A" roles="N/A" packet-incoming-interface="ge-0/0/2.0"] <14>1 2011-11-17T23:41:48 topstar RT_FLOW - RT_FLOW_SESSION_CLOSE [junos@2636.1.1.1.2.34 reason="response received" source-address="3001::2" source-port="0" destination-address="5001::2" destination-port="17420" service-name="icmpv6" nat-source-address="3001::2" nat-source-port="0" nat-destination-address="5001::2" nat-destination-port="17420" src-nat-rule-name="None" dst-nat-rule-name="None" protocol-id="58" policy-name="lsys1trust-to-lsys1trust" source-zone-name="lsys1-trust" destination-zone-name="lsys1-trust" session-id-32="60000218" packets-from-client="1" bytes-from-client="104" packets-from-server="1" bytes-from-server="104" elapsed-time="3" application="UNKNOWN" nested-application="UNKNOWN" username="N/A" roles="N/A" packet-incoming-interface="ge-0/0/2.0" encrypted="No "] <14>1 2011-11-17T23:41:48 topstar RT_FLOW - RT_FLOW_SESSION_CLOSE_LS [junos@2636.1.1.1.2.34 logical-system-name="LSYS1" reason="response received" source-address="3001::2" source-port="0" destination-address="5001::2" destination-port="17420" service-name="icmpv6" nat-source-address="3001::2" nat-source-port="0" nat-destination-address="5001::2" nat-destination-port="17420" src-nat-rule-name="None" dst-nat-rule-name="None" protocol-id="58" policy-name="lsys1trust-to-lsys1trust" source-zone-name="lsys1-trust" destination-zone-name="lsys1-trust" session-id-32="60000218" packets-from-client="1" bytes-from-client="104" packets-from-server="1" bytes-from-server="104" elapsed-time="3" application="UNKNOWN" nested-application="UNKNOWN" username="N/A" roles="N/A" packet-incoming-interface="ge-0/0/2.0" encrypted="No "] ... user@host>show security log file bin_msg logical-system LSYS1 <14>1 2011-11-17T23:41:46 topstar RT_FLOW - RT_FLOW_SESSION_CREATE_LS [junos@2636.1.1.1.2.34 logical-system-name="LSYS1" source-address="3001::2" source-port="0" destination-address="5001::2" destination-port="17420" service-name="icmpv6" nat-source-address="3001::2" nat-source-port="0" nat-destination-address="5001::2" nat-destination-port="17420" src-nat-rule-name="None" dst-nat-rule-name="None" protocol-id="58" policy-name="lsys1trust-to-lsys1trust" source-zone-name="lsys1-trust" destination-zone-name="lsys1-trust" session-id-32="60000218" username="N/A" roles="N/A" packet-incoming-interface="ge-0/0/2.0"] <14>1 2011-11-17T23:41:48 topstar RT_FLOW - RT_FLOW_SESSION_CLOSE [junos@2636.1.1.1.2.34 reason="response received" source-address="3001::2" source-port="0" destination-address="5001::2" destination-port="17420" service-name="icmpv6" nat-source-address="3001::2" nat-source-port="0" nat-destination-address="5001::2" nat-destination-port="17420" src-nat-rule-name="None" dst-nat-rule-name="None" protocol-id="58" policy-name="lsys1trust-to-lsys1trust" source-zone-name="lsys1-trust" destination-zone-name="lsys1-trust" session-id-32="60000218" packets-from-client="1" bytes-from-client="104" packets-from-server="1" bytes-from-server="104" elapsed-time="3" application="UNKNOWN" nested-application="UNKNOWN" username="N/A" roles="N/A" packet-incoming-interface="ge-0/0/2.0" encrypted="No "] <14>1 2011-11-17T23:41:48 topstar RT_FLOW - RT_FLOW_SESSION_CLOSE_LS [junos@2636.1.1.1.2.34 logical-system-name="LSYS1" reason="response received" source-address="3001::2" source-port="0" destination-address="5001::2" destination-port="17420" service-name="icmpv6" nat-source-address="3001::2" nat-source-port="0" nat-destination-address="5001::2" nat-destination-port="17420" src-nat-rule-name="None" dst-nat-rule-name="None" protocol-id="58" policy-name="lsys1trust-to-lsys1trust" source-zone-name="lsys1-trust" destination-zone-name="lsys1-trust" session-id-32="60000218" packets-from-client="1" bytes-from-client="104" packets-from-server="1" bytes-from-server="104" elapsed-time="3" application="UNKNOWN" nested-application="UNKNOWN" username="N/A" roles="N/A" packet-incoming-interface="ge-0/0/2.0" encrypted="No "] ... user@host>show security log file bin_msg tenant TSYS1 <14>1 2011-11-17T23:41:46 topstar RT_FLOW - RT_FLOW_SESSION_CREATE_LS [junos@2636.1.1.1.2.34 logical-system-name="LSYS1" source-address="3001::2" source-port="0" destination-address="5001::2" destination-port="17420" service-name="icmpv6" nat-source-address="3001::2" nat-source-port="0" nat-destination-address="5001::2" nat-destination-port="17420" src-nat-rule-name="None" dst-nat-rule-name="None" protocol-id="58" policy-name="lsys1trust-to-lsys1trust" source-zone-name="lsys1-trust" destination-zone-name="lsys1-trust" session-id-32="60000218" username="N/A" roles="N/A" packet-incoming-interface="ge-0/0/2.0"] <14>1 2011-11-17T23:41:48 topstar RT_FLOW - RT_FLOW_SESSION_CLOSE [junos@2636.1.1.1.2.34 reason="response received" source-address="3001::2" source-port="0" destination-address="5001::2" destination-port="17420" service-name="icmpv6" nat-source-address="3001::2" nat-source-port="0" nat-destination-address="5001::2" nat-destination-port="17420" src-nat-rule-name="None" dst-nat-rule-name="None" protocol-id="58" policy-name="lsys1trust-to-lsys1trust" source-zone-name="lsys1-trust" destination-zone-name="lsys1-trust" session-id-32="60000218" packets-from-client="1" bytes-from-client="104" packets-from-server="1" bytes-from-server="104" elapsed-time="3" application="UNKNOWN" nested-application="UNKNOWN" username="N/A" roles="N/A" packet-incoming-interface="ge-0/0/2.0" encrypted="No "] <14>1 2011-11-17T23:41:48 topstar RT_FLOW - RT_FLOW_SESSION_CLOSE_LS [junos@2636.1.1.1.2.34 logical-system-name="LSYS1" reason="response received" source-address="3001::2" source-port="0" destination-address="5001::2" destination-port="17420" service-name="icmpv6" nat-source-address="3001::2" nat-source-port="0" nat-destination-address="5001::2" nat-destination-port="17420" src-nat-rule-name="None" dst-nat-rule-name="None" protocol-id="58" policy-name="lsys1trust-to-lsys1trust" source-zone-name="lsys1-trust" destination-zone-name="lsys1-trust" session-id-32="60000218" packets-from-client="1" bytes-from-client="104" packets-from-server="1" bytes-from-server="104" elapsed-time="3" application="UNKNOWN" nested-application="UNKNOWN" username="N/A" roles="N/A" packet-incoming-interface="ge-0/0/2.0" encrypted="No "] ... user@host>show security log stream file s1_f1 <14>1 2011-11-17T23:41:46 topstar RT_FLOW - RT_FLOW_SESSION_CREATE_LS [junos@2636.1.1.1.2.34 logical-system-name="LSYS1" source-address="3001::2" source-port="0" destination-address="5001::2" destination-port="17420" service-name="icmpv6" nat-source-address="3001::2" nat-source-port="0" nat-destination-address="5001::2" nat-destination-port="17420" src-nat-rule-name="None" dst-nat-rule-name="None" protocol-id="58" policy-name="lsys1trust-to-lsys1trust" source-zone-name="lsys1-trust" destination-zone-name="lsys1-trust" session-id-32="60000218" username="N/A" roles="N/A" packet-incoming-interface="ge-0/0/2.0"] <14>1 2011-11-17T23:41:48 topstar RT_FLOW - RT_FLOW_SESSION_CLOSE [junos@2636.1.1.1.2.34 reason="response received" source-address="3001::2" source-port="0" destination-address="5001::2" destination-port="17420" service-name="icmpv6" nat-source-address="3001::2" nat-source-port="0" nat-destination-address="5001::2" nat-destination-port="17420" src-nat-rule-name="None" dst-nat-rule-name="None" protocol-id="58" policy-name="lsys1trust-to-lsys1trust" source-zone-name="lsys1-trust" destination-zone-name="lsys1-trust" session-id-32="60000218" packets-from-client="1" bytes-from-client="104" packets-from-server="1" bytes-from-server="104" elapsed-time="3" application="UNKNOWN" nested-application="UNKNOWN" username="N/A" roles="N/A" packet-incoming-interface="ge-0/0/2.0" encrypted="No "] <14>1 2011-11-17T23:41:48 topstar RT_FLOW - RT_FLOW_SESSION_CLOSE_LS [junos@2636.1.1.1.2.34 logical-system-name="LSYS1" reason="response received" source-address="3001::2" source-port="0" destination-address="5001::2" destination-port="17420" service-name="icmpv6" nat-source-address="3001::2" nat-source-port="0" nat-destination-address="5001::2" nat-destination-port="17420" src-nat-rule-name="None" dst-nat-rule-name="None" protocol-id="58" policy-name="lsys1trust-to-lsys1trust" source-zone-name="lsys1-trust" destination-zone-name="lsys1-trust" session-id-32="60000218" packets-from-client="1" bytes-from-client="104" packets-from-server="1" bytes-from-server="104" elapsed-time="3" application="UNKNOWN" nested-application="UNKNOWN" username="N/A" roles="N/A" packet-incoming-interface="ge-0/0/2.0" encrypted="No "] ... user@host>show security log stream file s1_f1 logical-system LSYS1 <14>1 2011-11-17T23:41:46 topstar RT_FLOW - RT_FLOW_SESSION_CREATE_LS [junos@2636.1.1.1.2.34 logical-system-name="LSYS1" source-address="3001::2" source-port="0" destination-address="5001::2" destination-port="17420" service-name="icmpv6" nat-source-address="3001::2" nat-source-port="0" nat-destination-address="5001::2" nat-destination-port="17420" src-nat-rule-name="None" dst-nat-rule-name="None" protocol-id="58" policy-name="lsys1trust-to-lsys1trust" source-zone-name="lsys1-trust" destination-zone-name="lsys1-trust" session-id-32="60000218" username="N/A" roles="N/A" packet-incoming-interface="ge-0/0/2.0"] <14>1 2011-11-17T23:41:48 topstar RT_FLOW - RT_FLOW_SESSION_CLOSE [junos@2636.1.1.1.2.34 reason="response received" source-address="3001::2" source-port="0" destination-address="5001::2" destination-port="17420" service-name="icmpv6" nat-source-address="3001::2" nat-source-port="0" nat-destination-address="5001::2" nat-destination-port="17420" src-nat-rule-name="None" dst-nat-rule-name="None" protocol-id="58" policy-name="lsys1trust-to-lsys1trust" source-zone-name="lsys1-trust" destination-zone-name="lsys1-trust" session-id-32="60000218" packets-from-client="1" bytes-from-client="104" packets-from-server="1" bytes-from-server="104" elapsed-time="3" application="UNKNOWN" nested-application="UNKNOWN" username="N/A" roles="N/A" packet-incoming-interface="ge-0/0/2.0" encrypted="No "] <14>1 2011-11-17T23:41:48 topstar RT_FLOW - RT_FLOW_SESSION_CLOSE_LS [junos@2636.1.1.1.2.34 logical-system-name="LSYS1" reason="response received" source-address="3001::2" source-port="0" destination-address="5001::2" destination-port="17420" service-name="icmpv6" nat-source-address="3001::2" nat-source-port="0" nat-destination-address="5001::2" nat-destination-port="17420" src-nat-rule-name="None" dst-nat-rule-name="None" protocol-id="58" policy-name="lsys1trust-to-lsys1trust" source-zone-name="lsys1-trust" destination-zone-name="lsys1-trust" session-id-32="60000218" packets-from-client="1" bytes-from-client="104" packets-from-server="1" bytes-from-server="104" elapsed-time="3" application="UNKNOWN" nested-application="UNKNOWN" username="N/A" roles="N/A" packet-incoming-interface="ge-0/0/2.0" encrypted="No "] ... user@host>show security log stream file s1_f1 tenant TSYS1 <14>1 2011-11-17T23:41:46 topstar RT_FLOW - RT_FLOW_SESSION_CREATE_LS [junos@2636.1.1.1.2.34 logical-system-name="LSYS1" source-address="3001::2" source-port="0" destination-address="5001::2" destination-port="17420" service-name="icmpv6" nat-source-address="3001::2" nat-source-port="0" nat-destination-address="5001::2" nat-destination-port="17420" src-nat-rule-name="None" dst-nat-rule-name="None" protocol-id="58" policy-name="lsys1trust-to-lsys1trust" source-zone-name="lsys1-trust" destination-zone-name="lsys1-trust" session-id-32="60000218" username="N/A" roles="N/A" packet-incoming-interface="ge-0/0/2.0"] <14>1 2011-11-17T23:41:48 topstar RT_FLOW - RT_FLOW_SESSION_CLOSE [junos@2636.1.1.1.2.34 reason="response received" source-address="3001::2" source-port="0" destination-address="5001::2" destination-port="17420" service-name="icmpv6" nat-source-address="3001::2" nat-source-port="0" nat-destination-address="5001::2" nat-destination-port="17420" src-nat-rule-name="None" dst-nat-rule-name="None" protocol-id="58" policy-name="lsys1trust-to-lsys1trust" source-zone-name="lsys1-trust" destination-zone-name="lsys1-trust" session-id-32="60000218" packets-from-client="1" bytes-from-client="104" packets-from-server="1" bytes-from-server="104" elapsed-time="3" application="UNKNOWN" nested-application="UNKNOWN" username="N/A" roles="N/A" packet-incoming-interface="ge-0/0/2.0" encrypted="No "] <14>1 2011-11-17T23:41:48 topstar RT_FLOW - RT_FLOW_SESSION_CLOSE_LS [junos@2636.1.1.1.2.34 logical-system-name="LSYS1" reason="response received" source-address="3001::2" source-port="0" destination-address="5001::2" destination-port="17420" service-name="icmpv6" nat-source-address="3001::2" nat-source-port="0" nat-destination-address="5001::2" nat-destination-port="17420" src-nat-rule-name="None" dst-nat-rule-name="None" protocol-id="58" policy-name="lsys1trust-to-lsys1trust" source-zone-name="lsys1-trust" destination-zone-name="lsys1-trust" session-id-32="60000218" packets-from-client="1" bytes-from-client="104" packets-from-server="1" bytes-from-server="104" elapsed-time="3" application="UNKNOWN" nested-application="UNKNOWN" username="N/A" roles="N/A" packet-incoming-interface="ge-0/0/2.0" encrypted="No "] ...
显示安全日志文件 test1.pb
user@host> show security log file test1.pb <14>1 2023-03-17T00:06:55 10.53.78.91 RT_LOG_SELF_TEST - SECINTEL_ACTION_LOG [junos@2636.1.1.1.2.129 category="secintel" sub-category="CC" action="block" action-detail="test" http-host="test" threat-severity="5" source-address="1.16.16.16" source-port="16384" destination-address="2.16.16.16" destination-port="32768" protocol-id="17" application="test" nested-application="test" feed-name="test" policy-name="test" profile-name="test" username="Fake username" roles="test" session-id="1" source-zone-name="Fake src zone" destination-zone-name="Fake dst zone" occur-count="3"] <14>1 2023-03-17T00:06:55 10.53.78.91 RT_LOG_SELF_TEST - AAMW_ACTION_LOG [junos@2636.1.1.1.2.129 hostname="test" file-category="virus" verdict-number="5" malware-info="Test-File" action="block" list-hit="test" file-hash-lookup="test" source-address="1.16.16.16" source-port="16384" destination-address="2.16.16.16" destination-port="32768" protocol-id="17" application="test" nested-application="test" policy-name="test" username="Fake username" roles="test" session-id="1" source-zone-name="Fake src zone" destination-zone-name="Fake dst zone" sample-sha256="da26ba1e13ce4702bd5154789ce1a699ba206c12021d9823380febd795f5b002" file-name="test_name" url="www.test.com"] <14>1 2023-03-17T00:06:55 10.53.78.91 RT_LOG_SELF_TEST - AAMW_MALWARE_EVENT_LOG [junos@2636.1.1.1.2.129 timestamp="fake-time" tenant-id="test" sample-sha256="da26ba1e13ce4702bd5154789ce1a699ba206c12021d9823380febd795f5b002" source-address="1.16.16.16" verdict-number="5" malware-info="Test-File" username="Fake username" hostname="test" session-id="1" url="www.test.com"] ...
发布信息
在 Junos OS 12.1 版中引入的命令。