Overview of System Logging

Junos OS generates system log messages (also called syslog messages) to record events that occur on the device, including the following:

• Routine operations, such as creation of an Open Shortest Path First (OSPF) protocol adjacency or a user login to the configuration database.

• Failure and error conditions, such as failure to access a configuration file or unexpected closure of a connection to a peer process.

• Emergency or critical conditions, such as power-down of the device due to excessive temperature.

Each system log message identifies the Junos OS process responsible for generating the message and provides a brief description of the operation or error that occurred. For detailed information about specific system log messages, see the System Log Explorer.

To configure the device to log system messages, configure the syslog statement at the [edit system] hierarchy level.

In Junos OS Release 17.3R1, the syslog-event daemon handles the fxp0 in dedicated management routing instance for IPv4 addressed remote host. In Junos OS Release 18.1R1, the syslog-event daemon supports IPv6-based configuration when connecting to a remote host or an archival site and fxp0 is moved to dedicated management instance. In Junos OS Release 18.4R1, the syslog client can send messages through any routing instance that you define at appropriate hierarchies. See routing-instance (Syslog).

In Junos OS Evolved, each node has the standard journalctl tool, which is an interface to retrieve and filter the system journal. System log messages are extracted from the system journal. The relay-eventd process runs on all nodes and retrieves events (based on the syslog configuration) from the system journal as well as error messages from the different applications and forwards them to the master-eventd process. The master-eventd process runs on the primary Routing Engine and writes the log messages and errors to disk.

Use the System Log Explorer application to view or compare system log messages in different releases.

In Junos OS Evolved there is no messages file on the backup Routing Engine. All backup Routing Engine logs are in the messages file on the primary Routing Engine node.

By default, Junos OS Evolved appends the node name to the hostname in system log messages; Junos OS does not. This action keeps Junos OS Evolved system log messages compliant with RFC5424. However, some monitoring systems may not identify a Junos OS Evolved hostname correctly, because the hostname-node name combination does not match any hostnames in the inventory of hostnames.

Starting in Junos OS Evolved Release 20.4R2, to ensure accurate identification of Junos OS Evolved hostnames in your monitoring system, use the set system syslog alternate-format configuration mode command. This command changes the format of the Junos OS Evolved system log messages. The node name is prepended to the process name in the message rather than appended to the hostname, thereby allowing the monitoring system to identify the hostname correctly.

For example, Junos OS system log messages do not print the origin process in system log messages coming from an FPC:

However, Junos OS Evolved messages append the node name to the hostname and do print the origin process for messages coming from a node, including FPCs:

If you have configured the alternate format for Junos OS Evolved system log messages, the same set of system log messages would look like this instead, with the hostname by itself:

Starting in Junos OS Release 22.1R1 on SRX Series and NFX Series devices and Junos OS Evolved Release 22.2R1 on QFX5130, QFX5200, QFX5220, and QFX5700 devices, we’ve added multiple events inside the event tag using the <event>UI_LOGIN_EVENT|UI_LOGOUT_EVENT</event> format, which has an option (|) to separate the events and to generate system log messages. Earlier to these releases, the event tag used the <event>UI_LOGIN_EVENT UI_LOGOUT_EVENT</event> format and for various combinations of <get-syslog-events> rpc filters was not getting logged.

Table 1 lists the Junos OS system logging facilities that you can specify in configuration statements at the [edit system syslog] hierarchy level.

Table 2 lists the severity levels that you can specify in configuration statements at the [edit system syslog] hierarchy level. The levels from emergency through info are in the order from highest severity (greatest effect on functioning) to lowest.

Unlike the other severity levels, the none level disables logging of a facility instead of indicating how seriously a triggering event affects routing functions. For more information, see Disabling the System Logging of a Facility.

Table 3 summarizes the default system log settings that apply to all routers that run the Junos OS and specifies which statement to include in the configuration to override the default value.

[edit system syslog]
host hostname {
    facility-override facility;
}

[edit system syslog]
file filename {
    structured-data;
}

[edit system syslog]
archive {
    files number;
}
file filename {
    archive {
        files number;
    }
}

[edit system syslog]
archive {
    size size;
}
file filename {
    archive {
        size size;
    }
}

[edit system syslog]
time-format format;

[edit system syslog]
archive {
    world-readable;
}
file filename {
    archive {
        world-readable;
    }
}

The following messages are generated by default on specific routers. To view any of these types of messages, you must configure at least one destination for messages as described in Junos OS Minimum System Logging Configuration.

• To log the kernel process message on an M Series, MX Series, or T Series router, include the kernel info statement at the appropriate hierarchy level:

• On a routing matrix composed of a TX Matrix router and T640 routers, the primary Routing Engine on each T640 router forwards all messages with a severity of info and higher to the primary Routing Engine on the TX Matrix router. This is equivalent to the following configuration statement included on the TX Matrix router:

• Starting in Junos OS Release 15.1X49-D10 and Junos OS Release 17.3R1, likewise on a routing matrix composed of a TX Matrix Plus router with connected T1600 or T4000 routers, the primary Routing Engine on each T1600 or T4000 LCC forwards to the primary Routing Engine on the TX Matrix Plus router all messages with a severity of info and higher. This is equivalent to the following configuration statement included on the TX Matrix Plus router:

  Note:

  From the perspective of the user interface, the routing matrix appears as a single router. The TX Matrix Plus router controls all the T1600 or T4000 routers connected to it in the routing matrix.

The syntax of a standard-format message generated by a Junos OS process or subroutine library depends on whether it includes the below priority informations:

• When the explicit-priority statement is included at the [filename] or [hostname] hierarchy level, a system log message has the following syntax:

• When directed to the console or to users, or when the explicit-priority statement is not included for files or remote hosts, a system log message has the following syntax:

Table 4 describes the message fields.

hostname	process[process-ID]