Configuring System Logging to One or More Remote Servers for Next Gen Services
To send system log messages about Next Gen Services to one or more remote servers, you can configure system logging for stream mode. This procedure describes the configuration process.
Next Gen Services system log messages are configured and collected at the service-set level.
In this procedure, you’ll configure a stream for the log messages between each service set and each remote server that you want to send log messages.
Complete this procedure for each service-set and each remote server for which you want to collect logs and send logs.
You must enable global system logging for Next Gen Services in order to perform stream logging. See, Enabling Global System Logging for Next Gen Services.
To configure stream mode system logging for Next Gen Services:
- Specify the names of the service-set for which you want
to collect log messages.user@host# edit services service-set service-set-name syslog
For example specify the service-set name to ss1.
user@host# edit services service-set ss1 syslog - Specify the security transport protocol for syslog messages.[edit services service-set ss1 syslog]user@host# set transport protocol tls |tcp | udp
- (Optional) Specify the syslog source address.[edit services service-set ss1 syslog]user@host# set source-address 50.0.0.10
Best Practice The syslog source address can be any arbitrary IP address. It does not have to be an IP address that is assigned to the device. Rather, this IP address is used on the syslog collector to identify the syslog source. The best practice is to configure the source address as the IP address of the interface that the traffic is sent out on.
- Specify a local tag name for the log messages.[edit services service-set ss1 syslog]user@host# set local-log-tag SYSLOG
- Enable stream mode system logging for the service-set.
- Specify a name for the stream.[edit services service-set ss1 syslog]user@host# set stream stream-name
For example, let’s call the stream: stream-aa
[edit services service-set ss1 syslog]user@host# edit stream stream-aa - Specify the categories for which you want to collect events.[edit services service-set ss1 syslog stream stream-aa]user@host# set category
For example, to collect logs for stateful firewall, sessions and NAT:
[edit services service-set ss1 syslog stream stream-aa]user@host# set category sfw, session, nat - Specify the file format for the log.[edit services service-set ss1 syslog stream stream-aa]user@host# set format sd-syslog
- Specify the IP address of syslog server to receive log
messages,[edit services service-set ss1 syslog stream stream-aa]user@host# set host address
- Specify the level of severity for the stream.[edit services service-set ss1 syslog stream stream-aa]user@host# set severity severity-level