Use Nonstandard System Log Messages to Trigger Event Policies
Some of the system log messages that you can reference in an
event policy are not listed in the output of the set event-options
policy policy-name events ? command. These
system log messages have an event ID and a message attribute. Event IDs are
based on the origin of the message, as shown in Table 1.
Event ID |
Origin |
|---|---|
SYSTEM |
Messages from Junos processes and utilities |
KERNEL |
Messages from the kernel |
PIC |
Messages from PICs and Flexible PIC Concentrators (FPCs) |
To trigger an event policy based on the event types shown in Table 1, include the events event-id statement and the
attributes-match statement with the
event-id.message matches
"message" attribute at the [edit event-options
policy policy-name] hierarchy level.
[edit event-options policy policy-name] events event-id; attributes-match { event-id.message matches "message"; }
For example, the following event policy references a KERNEL system log
message. The event policy executes the raise-trap action only if a
KERNEL event containing a message that matches "exited on signal
11" occurs.
[edit event-options]
policy kernel-policy {
events KERNEL;
attributes-match {
KERNEL.message matches "exited on signal 11";
}
then {
raise-trap;
}
}