Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

 
 

Understanding the Implementation of System Log Messages on the QFabric System

This topic provides an overview of system log (syslog) messages as implemented on the QFabric system.

The QFabric system monitors events that occur on its component devices and distributes system log messages about those events to all external system log message servers (hosts) that are configured. Component devices may include Node devices, Interconnect devices, Director devices, and the Virtual Chassis. Messages are stored for viewing only in the QFabric system database. To view the messages, issue the show log command.

You configure system log messages by using the host and file statements at the [edit system syslog] hierarchy level. Use the show log filename operational mode command to view the messages.

Note:

On the QFabric system, a syslog file named messages with a size of 100 MB is configured by default. If you do not configure a filename, you can use the default filename messages with the show log filename command.

All messages with a severity level of notice or higher are logged. Messages with a facility level of interactive-commands on Node devices are not logged.

The QFabric system supports the following system log message features:

  • The file filename and host hostname statements at the [edit system syslog] hierarchy level are supported. Other statements at that hierarchy level are not supported.

  • You can specify the maximum amount of data that is displayed when you issue the show log filename command by configuring the file filename archive maximum-file-size statement.

  • You can specify that one or more system log message servers receive messages, which are sent to each server that is configured.

  • If you configured an alias for a device or interface, the alias is displayed in the message for the device or interface.

  • The level of detail that is included in a message depends on the facility and severity levels that are configured. Messages include the highest level of detail available for the configured facility and severity levels.

  • The unit of time is is measured and displayed in seconds, and not milliseconds. If you attempt to configure the time-format option in milliseconds, the log output displays 000.

Starting in Junos OS Release 13.1, the QFabric system supports these additional syslog features:

  • You can filter the output of the show log filename operational mode command by device type and device ID or device alias when you specify the device-type (device-id | device-alias) optional parameters. Device types include director-device, infrastructure-device, interconnect-device, and node-device.

  • You can specify the syslog structured data output format when you configure the structured-data statement at the [edit system syslog file filename] and [edit system syslog host hostname] hierarchy levels.

    Note:

    Information displayed in the structured data output for system logs originating from the Director software may not be complete.

  • You can filter the types of logs that the Director group collects from a component device when you configure the filter all facility severity or filter all match “regular-expression” statements at the [edit system syslog] hierarchy level.

Unsupported syslog features include:

  • File access to syslog messages

  • Monitoring of syslog messages

Related Documentation