mode (Security Log)

Syntax

Hierarchy Level

Description

Set the mode of logging (event for traditional system logging or stream for streaming security logs through a revenue port to a server).

Options

• event— Process security logs in the control plane.

• stream— Process security logs directly in the forwarding plane.

• stream-event— Process security logs in the control and forwarding plane.

Default:

• event is a default mode on SRX100, SRX110, SRX210, SRX220, SRX240, SRX300, SRX320, SRX340, SRX345, SRX550, SRX550M, and SRX650, devices.

  Apart from Junos OS Release 18.4R1, 18,4R2, 19.1 and 19.2R1, in all the other releases starting in Junos OS Release 18.3R3, the default logging mode for SRX300, SRX320, SRX340, SRX345, SRX550, and SRX550M devices is stream mode.

• stream is a default mode on SRX1400, SRX1500, SRX3400, SRX3600, SRX5400, SRX5600, SRX5800, SRX4100, and SRX4200 devices.

  When a device is configured in stream mode, logs are sent from the PFE to an external syslog server through a revenue port other than fxp0 interface. You cannot use fxp0 interface for stream mode irrespective of whether the fxp0 interface is part of the default routing instance or mgmt_junos routing instance.

  Starting with Junos OS Release 15.1X49-D140, the default mode for SRX1500 device is stream mode. Prior to Junos OS Release 15.1X49-D140, the default mode for SRX1500 device was event mode.

• event is a default mode on vSRX Virtual Firewall and vSRX3.0 devices.

Required Privilege Level

security—To view this statement in the configuration.

security-control—To add this statement to the configuration.

Release Information

Statement introduced in Junos OS Release 10.0.

The [edit logical-systems name security log] hierarchy level introduced in Junos OS Release 18.2R1.

The [edit tenants tenant-name security log] hierarchy level introduced in Junos OS Release 18.3R1.

stream-event option is introduced in Junos OS Release 20.2R1 for SRX Series Firewalls.