Configuring Event Logging

[Contents] [Prev] [Next] [Index] [Report an Error]

By default, event logging is enabled and has default settings. This section explains how to change settings to customize event logging to fit your needs.

Set a baseline for when the system begins logging messages.
host1#baseline log 11:12:55 April 30 2002
Set the log severity.
host1(config)#log severity warning
Remove the limit on the number of buffers available for an event category.
host1(config)#log unlimit qos
Set the log verbosity.
host1(config)#log verbosity low
Log messages to a specified destination.
host1(config)#log destination syslog 10.10.9.5 include ospfGeneral mplsGeneral os
Select fields to be added to logs.
host1(config)#log fields timestamp instance no-calling-task
Enable logs destined for a console to be displayed at the current console device.
host1#log here

The next sections explain how to configure individual and systemwide logs, how to format timestamps for log messages, and how to configure log filters.

baseline log

Use to set a baseline for logging events. Only log messages timestamped after the baseline appear when you enter the show log data delta command.
To use the current system time, do not enter any options.
To set a specific time, use the following syntax:
Hour:Minute[:Second]—Current time in 24-hour format. Seconds are optional.
utc—Enter this keyword to indicate that the time entered is in universal coordinated time (UTC), rather than local time.
To set a specific date, use the following syntax:
Month Day Year—You must spell out the name of the month.
last-reset—Causes the system to display log messages generated since the last time the system was reset
Examples
host1#baseline log 11:12:55 April 30 2002 host1#baseline log last-reset
There is no no version.
See baseline log.

log destination

Use to log messages to the specified destination, including system log, console, and nv-file (nonvolatile storage).

Note: You can display traffic logs—such as ipTraffic, icmpTraffic, tcpTraffic, and udpTraffic—only through the show log data command or from the SRP module console. You cannot redirect traffic logs elsewhere, such as to a system log or nonvolatile storage file, or to a Telnet session.

Use the severity keyword to limit the messages logged based on priority level.
The following information applies to logging messages to system log servers.
- You can have multiple system log servers, but must configure logging to each one separately.
- A particular message within a specified event category is logged to a particular system log server only if the priority of the message is greater than or equal to both the priority of the event category and the priority of that system log server.
- If you log messages to a system log server, you can also specify:
  - facility—Specifies a facility ID on the system log destination host. The range is 0–7, representing the logging facilities local0–local7.
  - include—Logs only the listed categories to system log; no other categories are logged unless specifically included by issuing this command again.
  - exclude—Logs all categories to system log except the listed categories; all other categories are logged unless specifically excluded by issuing this command again.
- Issuing an include command after an exclude command (or vice versa) overrides the earlier command. Therefore, you cannot enter a command including certain categories and then follow it with a command excluding others. Similarly, you cannot enter a command excluding certain categories and then follow it with a command including others.
- You can issue successive include commands or successive exclude commands; in this case, the successive commands expand the list of included or excluded categories.
Example 1—The first command causes only the osfpGeneral, mplsGeneral, and os event categories to be logged to system log at 10.10.9.5. The second command reverses this inclusion and restores the logging of all event categories.
host1(config)#log destination syslog 10.10.9.5 include ospfGeneral mplsGeneral os host1(config)#no log destination syslog 10.10.9.5
Example 2—The first command again causes only the osfpGeneral, mplsGeneral, and os event categories to be logged to system log at 10.10.9.5. The second command reverses the inclusion of ospfGeneral and os. The mplsGeneral category is still included and is thus the only category logged.
host1(config)#log destination syslog 10.10.9.5 include ospfGeneral mplsGeneral os host1(config)#no log destination syslog 10.10.9.5 include ospfGeneral os
Example 3—The first command causes the isisGeneral, ipRoutePolicy, and ipTraffic event categories to be excluded from logging to system log at 10.1.2.3. The second command reverses this exclusion and restores the logging of all event categories.
host1(config)#log destination syslog 10.1.2.3 exclude isisGeneral ipRoutePolicy ipTraffic host1(config)#no log destination syslog 10.1.2.3 exclude
Example 4—The first command again causes the isisGeneral, ipRoutePolicy, and ipTraffic event categories to be excluded from logging to system log at 10.1.2.3. The second command reverses the exclusion of ipRoutePolicy and ipTraffic. The isisGeneral category is still excluded; all other events are logged.
host1(config)#log destination syslog 10.1.2.3 exclude isisGeneral ipRoutePolicy ipTraffic host1(config)#no log destination syslog 10.1.2.3 exclude isisGeneral
Example 5—The first command causes the isisGeneral event category to be excluded from logging to system log at 10.1.2.3. The second command causes ospfGeneral to also be excluded from logging.
host1(config)#log destination syslog 10.1.2.3 exclude isisGeneral host1(config)#log destination syslog 10.1.2.3 exclude ospfGeneral
Example 6—The first command causes the isisGeneral event category to be excluded from logging to system log at 10.1.2.3; all other events are logged. The second command overrides the first and causes the exclusion of all events except ospfGeneral.
host1(config)#log destination syslog 10.1.2.3 exclude isisGeneral host1(config)#log destination syslog 10.1.2.3 include ospfGeneral
Use the no version to reverse the effects of previous commands or restore the default, which is to log all event categories.
See log destination.

log destination syslog source

Use to specify a source interface type and location for events logged to system log at the specified IP address.
Overrides the actual source interface type and location. The IP address associated with the specified source interface is used as the source address for subsequent system log messages.
Example
host1(config)#log destination syslog 10.1.2.3 source atm 0/1
Use the no version to restore the actual source interface type and location.
See log destination syslog source.

log engineering

Use to enable engineering logs.
Provides troubleshooting information to assist you when contacting Juniper Networks Technical Assistance Center (JTAC).
Example
host1(config)#log engineering
Use the no form of this command to disable engineering logs.
See log engineering.

log fields

Use to select fields to be added to all logs. These fields include a timestamp for the message, an instance identifier, and the name of the internal software application that created the message.
Example
host1(config)#log fields timestamp instance no-calling-task
Use the no version to restore the default log field settings.
See log fields.

log here

Use to enable logs destined for a console to be displayed at the current console.
By default, the local console automatically receives all log messages if console is a destination. The exception is the cliCommand log, whose log events do not appear on the console.
By default, Telnet consoles do not receive log messages.
Example
host1#log here
Use the no version to disable logs destined for a console from being displayed on this console.
See log here.

log severity

Use to set the severity level for systemwide logs (that is, when you do not specify an individual event category) or for a specific event category. For a list of severity values, see Table 3.

Note: Assigning a log severity to an individual event category changes its state to Assigned. You cannot change the severity of that event category using systemwide level commands until you return the event category to its default, unassigned state with the no log severity command.

If you do not specify a category, the severity value changes for all categories except individual categories for which you previously set a specific severity level. See Configuring Log Severity for Individual and Systemwide Logs for details.
Each event category has its own default severity value. For most categories, the default is Error.
To disable all default level log messages, use the off keyword without specifying an event category.
To disable individual level log messages, use the off keyword and specify the event category that you want to disable.
Example
host1(config)#log severity warning
Use the no version to return the systemwide (when assigned) or default severity values to event categories.
Use the no version with an* (asterisk) to return all event categories (modified either systemwide or individually) to their default severity setting. For example:
host1(config)#no log severity *
See log severity.

log unlimit

Use to remove the limit on the number of outstanding buffers for an event category, such as when the system is dropping logs of a particular category.
Example
host1(config)#log unlimit qos
Use the no version to return to the default value.
See log unlimit.

log verbosity

Use to set the verbosity level for a selected category or for all categories.
If you do not specify a category, then the verbosity level is set for all categories.
The default verbosity setting for all logs is low.
Example
host1(config)#log verbosity low
Use the no version to return to the default verbosity (low) for the selected category.
See log verbosity.

[Contents] [Prev] [Next] [Index] [Report an Error]