Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

 
ON THIS PAGE
 

Syslog Support on cRPD

Eventd provides event interface to cRPD processes (RPD/AUDITD/MGD) and supports automated event policies execution.

Eventd is a process that supports forwarding syslog messages to a configured remote host in containerized RPD (cRPD). You can configure syslog messages using the following options:

Format Option Description
file

filename

Eventd writes the syslog messages to the file. You can create a file and forward all the syslog messages to the file based on the priority using the command set system syslog file <filename> facility priority.

match-strings

You can filter the messages based on particular string message using the command set system syslog file test match-strings.

structured data

You can log the system messages in structured format using the command set system syslog file test structured data.

host

ipaddress

Host option allows you to log the message in remote host using the command set system syslog host <ipaddress> <facility> <priority>.

match-strings

Match string option with host allows you to filter messages based on particular match string using the command set system syslog host <ipaddress> match-strings.

structured-data

Structured format option at host level allows to log the message to remote host in structured format using the command set system syslog host <ipaddress> structured-data.

log-prefix

Log prefix option at host level allow you to add text string for every syslog message that is forwarded to remote host using the command set system syslog host <ipaddress> log-prefix "<string-name>".

source address

Source address option at host level allows you to log the syslog to the remote host with the specified valid source address using the command set system syslog host <ipaddress> source address <ipaddress> <facility> <priority>

source address

ipaddress

Source address option at syslog level allows you to log the syslog to the remote host with specified source address using the command set system syslog source address <ipaddress> file <file-name> <facility> <priority>

Directing System Log Messages to Remote Machine

To direct the system log messages to a remote machine, include the host statement at the [edit system syslog] hierarchy level:

To send system log messages to a remote machine, use the host hostname statement. Specify the machine’s IPv4/IPv6 address or fully qualified hostname for WAN and data ports. The remote machine must be running the standard syslogd utility. In each system log message directed to the remote machine, the hostname of the local Routing Engine appears after the timestamp to indicate that it is the source for the message.

For the list of logging facilities and severity levels to configure under the host statement, see Specifying the Facility and Severity of Messages to Include in the Log.

To record facility and severity level information in each message, include the explicit-priority statement. For more information, see Including Priority Information in System Log Messages.

For information about the match statement, see Using Strings and Regular Expressions to Refine the Set of Logged Messages.

When directing messages to remote machines, you can include the source-address statement to specify the IP address of the switch that is reported in the messages as their source. In each host statement, you can also include the facility-override statement to assign an alternative facility and the log-prefix statement to add a string to each message.

Configure Server Authentication

To configure the Server Authentication in the device:

  1. Specify the syslog server that receives the system log messages. You can specify the IP address of the syslog server or a fully qualified hostname.

    root@crpd1# set system syslog host 10.102.70.233 any any

  2. Specify the port number of the syslog server.

    root@crpd1# set system syslog host 10.102.70.233 port 10514

  3. Specify the syslog transport protocol for the device.

    root@crpd1# set system syslog host 10.102.70.223 transport udp

  4. Configure the device to send all log messages.

    root@crpd1# set system syslog file filename any any

  5. In configuration mode, confirm your configuration by using the show system command.

    You can view the log messages using the show log messages command.

Related Documentation