Configure the Local Syslog to Track a Specific Pattern
Learn about how to configure the local syslog on a MX204, MX301, MX304, MX10004, or MX10008 router.
Use on-box syslog to track specific events for troubleshooting. The default
messages file can become too verbose during incidents. Although match
conditions provide basic filtering, configure additional syslog files for specific
purposes.
Use these templates as a reference to create custom syslog files:
Common use cases:
- Track control plane events
- Track data plane errors
Control Plane Event Tracking
Track RPD (routing daemon) and BFD state‑change events (up and down). Filter physical and logical interface events, selected BGP events (such as session state changes and prefix‑limit violations), and LACP state changes. Modify the event list as needed.
set system syslog file proto-event any info set system syslog file proto-event authorization none set system syslog file proto-event daemon info set system syslog file proto-event kernel any set system syslog file proto-event interactive-commands none set system syslog file proto-event match "^RPD_.*DOWN$|^RPD_.*UP$|^BFDD_.*DOWN$|BFDD_.*UP$|RPD_BGP_NEIGHBOR_STATE_CHANGED|BGP_PREFIX_THRESH|LINK_DOWN|LINK_UP|lacp_update_state_userspace" set system syslog file proto-event archive size 2m set system syslog file proto-event archive files 10 set system syslog file proto-event archive world-readable
Show or monitor all protocols events:
show log proto-event or monitor start proto-event
Data Plane Monitoring
The second syslog file tracks only hardware-related syslog matching the patterns: CMERROR, LUSS, MQSS and XQSS.
- CMERROR—Hardware error handler that manages errors at the FPC level.
- LUSS—Lookup engine within the Trio ASIC.
- MQSS—WAN and fabric processing block within the Trio ASIC.
- XQSS—Queuing (QoS) processing block within the Trio ASIC.
set system syslog file trio-event any info set system syslog file trio-event authorization none set system syslog file trio-event daemon none set system syslog file trio-event kernel any set system syslog file trio-event interactive-commands none set system syslog file trio-event match "CMERROR|XQSS|LUSS|MQSS" set system syslog file trio-event archive size 2m set system syslog file trio-event archive files 10 set system syslog file trio-event archive world-readable
Show or monitor all Trio-related events:
show log trio-event or monitor start trio-event