Understanding the Implementation of System Log Messages on the QFabric System
This topic provides an overview of system log (syslog) messages as implemented on the QFabric system.
The QFabric system monitors
events that occur on its component devices and distributes system
log messages about those events to all external system log message
servers (hosts) that are configured. Component devices may include
Node devices, Interconnect devices, Director devices, and the Virtual
Chassis. Messages are stored for viewing only in the QFabric system
database. To view the messages, issue the show log
command.
You configure system log messages by using the host
and file
statements at the [edit system syslog]
hierarchy level. Use the show log filename
operational mode command to
view the messages.
On the QFabric system, a syslog file named messages with a size of 100 MB is configured by
default. If you do not configure a filename, you can use the default
filename messages with the show
log filename
command.
All messages with a severity level of notice
or higher
are logged. Messages with a facility level of interactive-commands
on Node devices are not logged.
The QFabric system supports the following system log message features:
The
file filename
andhost hostname
statements at the[edit system syslog]
hierarchy level are supported. Other statements at that hierarchy level are not supported.You can specify the maximum amount of data that is displayed when you issue the
show log filename
command by configuring thefile filename archive maximum-file-size
statement.You can specify that one or more system log message servers receive messages, which are sent to each server that is configured.
If you configured an alias for a device or interface, the alias is displayed in the message for the device or interface.
The level of detail that is included in a message depends on the facility and severity levels that are configured. Messages include the highest level of detail available for the configured facility and severity levels.
The unit of time is is measured and displayed in seconds, and not milliseconds. If you attempt to configure the
time-format
option in milliseconds, the log output displays000
.
Starting in Junos OS Release 13.1, the QFabric system supports these additional syslog features:
You can filter the output of the
show log filename
operational mode command by device type and device ID or device alias when you specify thedevice-type (device-id | device-alias)
optional parameters. Device types includedirector-device
,infrastructure-device
,interconnect-device
, andnode-device
.You can specify the syslog structured data output format when you configure the
structured-data
statement at the[edit system syslog file filename]
and[edit system syslog host hostname]
hierarchy levels.Note:Information displayed in the structured data output for system logs originating from the Director software may not be complete.
You can filter the types of logs that the Director group collects from a component device when you configure the
filter all facility severity
orfilter all match “regular-expression”
statements at the[edit system syslog]
hierarchy level.
Unsupported syslog features include:
File access to syslog messages
Monitoring of syslog messages