log (Security)
Syntax
log {
(source-address source-address | source-interface source-interface);
cache {
exclude name {
destination-address destination-address;
destination-port destination-port;
event-id event-id;
failure;
interface-name interface-name;
policy-name policy-name;
process process;
protocol protocol;
source-address source-address;
source-port source-port;
success;
username username;
}
limit limit;
}
disable;
escape;
time-format (year | millisecond);
event-rate logs per second;
facility-override (authorization | daemon | ftp | kernel | local0 | local1 | local2 | local3 | local4 | local5 | local6 | local7 | user);
file {
files files;
name name;
path path;
size size;
}
format (binary | protobuf | sd-syslog | syslog);
max-database-record max-database-record;
message-rate-limit messages per second;
mode (event | stream | stream-event);
rate-cap logs per second;
report {
logs-per-table {
idp idp;
ipsec-vpn ipsec-vpn;
screen screen;
session-all session-all;
sky sky;
utm utm;
}
table-lifetime table-lifetime;
table-mode {
dense;
}
}
retry-count retry-count;
root-streaming;
stream stream-name {
category (all | content-security | fw-auth | screen | alg | nat | flow | sctp | gtp | ipsec | idp | rtlog |pst-ds-lite | appqos |secintel |aamw);
filter {
threat-attack;
}
format (binary | protobuf | sd-syslog | syslog | welf);
host {
ip-address;
port port-number;
routing-instanceinstance-name;
}
radius {
ipaddr {
backup backup;
primary primary;
}
port port number;
secret secret;
}
rate-limit {
log-rate;
}
severity (alert | critical | debug | emergency | error | info | notice | warning);
source-address {
ip-address;
}
time-format (year | millisecond);
transport {
protocol (tcp | tls | udp);
tcp-connections tcp-connections;
tls-profile tls-profile;
}
}
traceoptions {
file <filename> <files files> <match match> <size size> <(world-readable | no-world-readable)>;
flag name;
no-remote-trace;
}
transport {
protocol (tcp | tls | udp);
tcp-connections tcp-connections;
tls-profile tls-profile;
}
utc-timestamp;
}
Hierarchy Level
[edit security] [editlogical-systemsname security] [edittenantstenant-name security]
Description
Enabling tracing can adversely impact scale and performance and may increase security risk. We strongly recommend using the trace, tracing, or traceoptions commands only under the guidance of a JTAC support engineer. After collecting the debug information, immediately disable tracing to minimize risk and restore normal system performance.
Configure security log. Set the mode of logging (event for traditional system logging or stream for streaming security logs through a revenue port to a server). You can also specify all the other parameters for security logging.
Options
cache |
Cache security log events in the audit log buffer. |
disable |
Disable the security logging for the device. |
escape |
Escapes
the stream log forwarding to avoid parsing errors. Stream mode supports
escape in |
time-format |
Specify the year, the millisecond, or both in the timestamp. |
event-rate rate |
Limit the rate at which logs are streamed per second.
|
facility-override |
Alternate facility for logging to remote host. |
file |
Specify the security log file options for logs in binary format.
|
format |
Set the security log format for the device. |
max-database-record |
The following are the disk usage range limits for the database:
|
mode |
Control how security logs are processed and exported. |
rate-cap rate-cap-value |
Work with event mode only. This option limits the rate at which data plane logs are generated per second.
|
retry-countretry-count |
Specify the maximum number attempts to send accounting message to the RADIUS accounting server in case of a transmission failure. |
| root-streaming | Allows the user logical systems to generate the logs using the root logical system's stream configuration. |
source-address source-address |
Specify a source IP address or IP address used when exporting security logs, which is mandatory to configure stream host. |
source-interface interface-name |
Specify a source interface name, which is mandatory to configure stream host. The |
stream |
Every stream can configure file or host. |
traceoptions |
Specify security log daemon trace options. |
transport |
Set security log transport settings. |
utc-timestamp |
Specify to use UTC time for security log timestamps. |
The remaining statements are explained separately. See CLI Explorer.
Required Privilege Level
security—To view this statement in the configuration.
security-control—To add this statement to the configuration.
Release Information
Statement introduced in Junos OS Release 9.2.
The [edit logical-systems name security] and [edit tenants tenant-name security] hierarchy levels introduced
in Junos OS Release 19.1R1.
escape option added in Junos OS Release 20.2R1.
root-streaming option added in Junos OS Release 20.3R1.
protobuf option is introduced in Junos OS Release 23.2R1.
retry-count option is introduced in Junos OS Release 24.2R1.