Use Nonstandard System Log Messages to Trigger Event Policies
Some of the system log messages that you can reference in an
event policy are not listed in the output of the set event-options
policy policy-name events ? command. These
system log messages have an event ID and a message attribute. Event IDs are
based on the origin of the message, as shown in Table 1.
Event IDs |
Origin |
|---|---|
SYSTEM |
Messages from Junos daemons and utilities |
KERNEL |
Messages from the kernel |
PIC |
Messages from Physical Interface Cards (PICs) and Flexible PIC Concentrators (FPCs) |
LCC |
On a TX Matrix router, messages from a line-card chassis (LCC) |
SCC |
On a TX Matrix router, messages from a switch-card chassis (SCC) |
To base your event policy on the event types shown in Table 1, include the events event-id statement and the attributes-match statement with
the event-id.message matches "message" attribute at the [edit event-options
policy policy-name] hierarchy level:
[edit event-options policy policy-name] events event-id; attributes-match { event-id.message matches "message"; }
For example, the following event policy references a KERNEL system log
message. The event policy executes the raise-trap action only if a
KERNEL event containing a message that matches "exited on signal
11" occurs.
[edit event-options]
policy kernel-policy {
events KERNEL;
attributes-match {
KERNEL.message matches "exited on signal 11";
}
then {
raise-trap;
}
}