Configuring Event Logging

By default, event logging is enabled and has default settings. This section explains how to change settings to customize event logging to fit your needs.

• Set a baseline for when the system begins logging messages.

  host1#baseline log 11:12:55 April 30 2002

• Set the log severity.

  host1(config)#log severity warning

• Remove the limit on the number of buffers available for an event category.

  host1(config)#log unlimit qos

• Set the log verbosity.

  host1(config)#log verbosity low

• Log messages to a specified destination.

  host1(config)#log destination syslog 10.10.9.5 include ospfGeneral
  mplsGeneral os

• Select fields to be added to logs.

  host1(config)#log fields timestamp instance no-calling-task

• Enable logs destined for a console to be displayed at the current console device.

  host1#log here

The next sections explain how to configure individual and systemwide logs, how to format timestamps for log messages, and how to configure log filters.

baseline log

• Use to set a baseline for logging events. Only log messages timestamped after the baseline appear when you enter the show log data delta command.
• To use the current system time, do not enter any options.
• To set a specific time, use the following syntax:

  Hour:Minute[:Second]—Current time in 24-hour format. Seconds are optional.

• utc—Enter this keyword to indicate that the time entered is in universal coordinated time (UTC), rather than local time.
• To set a specific date, use the following syntax:

  Month Day Year—You must spell out the name of the month.

• last-reset—Causes the system to display log messages generated since the last time the system was reset
• Examples

  host1#baseline log 11:12:55 April 30 2002

  host1#baseline log last-reset

• There is no no version.
• See baseline log.

log destination

• Use to log messages to the specified destination, including system log, console, and nv-file (nonvolatile storage).

  Note: You can display traffic logs—such as ipTraffic, icmpTraffic, tcpTraffic, and udpTraffic—only through the show log data command or from the SRP module console. You cannot redirect traffic logs elsewhere, such as to a system log or nonvolatile storage file, or to a Telnet session.

• Use the severity keyword to limit the messages logged based on priority level.
• The following information applies to logging messages to system log servers.
  • You can have multiple system log servers, but must configure logging to each one separately.
  • A particular message within a specified event category is logged to a particular system log server only if the priority of the message is greater than or equal to both the priority of the event category and the priority of that system log server.
  • If you log messages to a system log server, you can also specify:
    • facility—Specifies a facility ID on the system log destination host. The range is 0–7, representing the logging facilities local0–local7.
    • include—Logs only the listed categories to system log; no other categories are logged unless specifically included by issuing this command again.
    • exclude—Logs all categories to system log except the listed categories; all other categories are logged unless specifically excluded by issuing this command again.
  • Issuing an include command after an exclude command (or vice versa) overrides the earlier command. Therefore, you cannot enter a command including certain categories and then follow it with a command excluding others. Similarly, you cannot enter a command excluding certain categories and then follow it with a command including others.
  • You can issue successive include commands or successive exclude commands; in this case, the successive commands expand the list of included or excluded categories.
• Example 1—The first command causes only the osfpGeneral, mplsGeneral, and os event categories to be logged to system log at 10.10.9.5. The second command reverses this inclusion and restores the logging of all event categories.

  host1(config)#log destination syslog 10.10.9.5 include ospfGeneral
  mplsGeneral os

  host1(config)#no log destination syslog 10.10.9.5

• Example 2—The first command again causes only the osfpGeneral, mplsGeneral, and os event categories to be logged to system log at 10.10.9.5. The second command reverses the inclusion of ospfGeneral and os. The mplsGeneral category is still included and is thus the only category logged.

  host1(config)#log destination syslog 10.10.9.5 include ospfGeneral mplsGeneral os

  host1(config)#no log destination syslog 10.10.9.5 include ospfGeneral os

• Example 3—The first command causes the isisGeneral, ipRoutePolicy, and ipTraffic event categories to be excluded from logging to system log at 10.1.2.3. The second command reverses this exclusion and restores the logging of all event categories.

  host1(config)#log destination syslog 10.1.2.3 exclude isisGeneral ipRoutePolicy ipTraffic

  host1(config)#no log destination syslog 10.1.2.3 exclude

• Example 4—The first command again causes the isisGeneral, ipRoutePolicy, and ipTraffic event categories to be excluded from logging to system log at 10.1.2.3. The second command reverses the exclusion of ipRoutePolicy and ipTraffic. The isisGeneral category is still excluded; all other events are logged.

  host1(config)#log destination syslog 10.1.2.3 exclude isisGeneral
  ipRoutePolicy ipTraffic

  host1(config)#no log destination syslog 10.1.2.3 exclude isisGeneral
  

• Example 5—The first command causes the isisGeneral event category to be excluded from logging to system log at 10.1.2.3. The second command causes ospfGeneral to also be excluded from logging.

  host1(config)#log destination syslog 10.1.2.3 exclude isisGeneral

  host1(config)#log destination syslog 10.1.2.3 exclude ospfGeneral

• Example 6—The first command causes the isisGeneral event category to be excluded from logging to system log at 10.1.2.3; all other events are logged. The second command overrides the first and causes the exclusion of all events except ospfGeneral.

  host1(config)#log destination syslog 10.1.2.3 exclude isisGeneral

  host1(config)#log destination syslog 10.1.2.3 include ospfGeneral

• Use the no version to reverse the effects of previous commands or restore the default, which is to log all event categories.
• Seelog destination.

log destination syslog source

• Use to specify a source interface type and location for events logged to system log at the specified IP address.
• Overrides the actual source interface type and location. The IP address associated with the specified source interface is used as the source address for subsequent system log messages.
• Example

  host1(config)#log destination syslog 10.1.2.3 source atm 0/1

• Use the no version to restore the actual source interface type and location.
• Seelog destination syslog source.

log engineering

• Use to enable engineering logs.
• Provides troubleshooting information to assist you when contacting Juniper Networks Technical Assistance Center (JTAC).
• Example

  host1(config)#log engineering

• Use the no form of this command to disable engineering logs.
• Seelog engineering.

log fields

• Use to select fields to be added to all logs. These fields include a timestamp for the message, an instance identifier, and the name of the internal software application that created the message.
• Example

  host1(config)#log fields timestamp instance no-calling-task

• Use the no version to restore the default log field settings.
• Seelog fields.

log here

• Use to enable logs destined for a console to be displayed at the current console.
• By default, the local console automatically receives all log messages if console is a destination. The exception is the cliCommand log, whose log events do not appear on the console.
• By default, Telnet consoles do not receive log messages.
• Example

  host1#log here

• Use the no version to disable logs destined for a console from being displayed on this console.
• Seelog here.

log severity

• Use to set the severity level for systemwide logs (that is, when you do not specify an individual event category) or for a specific event category. For a list of severity values, see Table 4.

  Note: Assigning a log severity to an individual event category changes its state to Assigned. You cannot change the severity of that event category using systemwide level commands until you return the event category to its default, unassigned state with the no log severity command.

• If you do not specify a category, the severity value changes for all categories except individual categories for which you previously set a specific severity level. See Configuring Log Severity for Individual and Systemwide Logs for details.
• Each event category has its own default severity value. For most categories, the default is Error.
• To disable all default level log messages, use the off keyword without specifying an event category.
• To disable individual level log messages, use the off keyword and specify the event category that you want to disable.
• Example

  host1(config)#log severity warning

• Use the no version to return the systemwide (when assigned) or default severity values to event categories.
• Use the no version with an* (asterisk) to return all event categories (modified either systemwide or individually) to their default severity setting. For example:

  host1(config)#no log severity *

• Seelog severity.

log unlimit

• Use to remove the limit on the number of outstanding buffers for an event category, such as when the system is dropping logs of a particular category.
• Example

  host1(config)#log unlimit qos

• Use the no version to return to the default value.
• Seelog unlimit.

log verbosity

• Use to set the verbosity level for a selected category or for all categories.
• If you do not specify a category, then the verbosity level is set for all categories.
• The default verbosity setting for all logs is low.
• Example

  host1(config)#log verbosity low

• Use the no version to return to the default verbosity (low) for the selected category.
• Seelog verbosity.

Copyright © 2008, Juniper Networks, Inc. All rights reserved. Trademark Notice.