ON THIS PAGE
Logging, SNMP, and Telemetry
Learn to enable system logging, SNMP, and telemetry services on the QFX5220, QFX5230, QFX5240, QFX5241, and QFX5250 Switches in your network.
System Logging (Syslog)
You can configure system logging (syslog) to maintain network stability, security, and performance. The syslog configuration enables network administrators to monitor, troubleshoot, and audit the device activities.
To configure syslog locally on a switch:
set system syslog file filename any notice set system syslog file filename authorization info
To configure remote syslog server (sending logs to an external syslog server):
set system syslog host syslog-server-ip-address any notice set system syslog host syslog-server-ip-address structured-data
To configure the source IP address used for syslog traffic:
set system syslog host ip-address source-address source-ip-address
SNMP
SNMP monitor network devices such as switches, routers, and other IP-based devices from a single management host. By default, SNMP is not enabled on a QFX Series Switch. However, the operating system running on these switches, Junos OS Evolved, supports SNMPv1, SNMPv2c, and SNMPv3.
To enable SNMP, you need to add the configuration statements at the [edit]
hierarchy level. The minimum configuration you can enable for SNMP is SNMP polling.
To define an SNMP community and set its permissions:
set snmp community community-name authorization authorization-value
For example:
set snmp community C1 authorization read-only
set snmp community C1 authorization read-write
To configure basic SNMP identity:
set snmp contact contact set snmp location location
To limit SNMP queries to trusted management ports:
set snmp community community-name authorization read-only set snmp community community-string clients mgmt-host-ip-address/prefix
For example:
set snmp community "noc_ro" authorization read-only set snmp community "noc_ro" clients 192.0.2.10/32
To configure SNMP traps:
set snmp community community-name authorization authorization-value set snmp trap-group trap-group-name version version-number set snmp trap-group trap-group-name targets ip-address community community-name set snmp trap-group trap-group-name categories link
For example:
set snmp community "noc_ro" authorization read-only set snmp trap-group "nms" version v2 set snmp trap-group "nms" targets 192.0.2.10 community "noc_ro" set snmp trap-group "nms" categories link
To verify whether SNMP is running after configuration, run the following command in operational mode:
run show snmp statistics
Telemetry
Junos telemetry is a telemetry solution developed to stream telemetry data from a Junos device. The QFX5220, QFX5230, QFX5240, QFX5241, and QFX5250 switches support Junos telemetry to stream real-time network data, such as traffic patterns, device status, error rates, and other metrics that provide insights into the network's health and behavior. For more information about Junos telemetry, see Understanding Junos Telemetry. For information about how to configure gRPC and verify telemetry streaming, see Understanding Authentication and Authorization for gRPC-Based Services.
Read configure mutual (bidirectional) authentication for gRPC services to learn how to verify that your QFX Series switches are running Junos OS Evolved and that a network device or a virtual machine running Linux can reach one of the traffic ports on the QFX Series switch. When mutual authentication is configured:
-
The server provides its public key certificate after establishing the channel.
-
The client uses the server's root CA certificate to authenticate the server.
-
The client also provides its certificate when it connects to the server, and the server validates the certificate. If the certificate validation is successful, the client is allowed to make calls.
Perform the following steps to configure and verify telemetry streaming on the QFX Series switches using gNMI.
To obtain the X.509 Certificates (server root certificate authority and server key pairs):
openssl genrsa -out server.key 4096 openssl req -new -x509 -sha256 -key serverRootCA.key -out serverRootCA.crt -days 3650 -subj "/C=US/ST=CA/L=Sunnyvale/O=Juniper/CN=serverRootCA" openssl genrsa -out server.key 4096 openssl req -new -key server.key -out server.csr -sha256 -subj "/C=US/ST=CA/L=Sunnyvale/O=Juniper/OU=serverRootCAOrg/CN=vJunosEvolved" openssl x509 -req -in server.csr -CA serverRootCA.crt -CAkey serverRootCA.key -CAcreateserial -out server.crt -days 365 -extfile server_ssl_cert_ext.cnf
Note:The gRPC server certificate must define either the server hostname in the Common Name (CN) field (the sample command above, vJunosEvolved is the server hostname), or the server IP address in the subjectAltName IP address field in the
server_ssl_cert_ext.cnffile (shown below). The client application must use the same value to establish the connection to the server. If the certificate defines the subjectAltName IP address field, the CN field is ignored during authentication.The
server_ssl_cert_ext.cnffile content is as follows:cat server_ssl_cert_ext.cnf #### include -extfile server_ssl_cert_ext.cnf in command to include extensions file #### openssl.cnf extensions = v3_sign [v3_sign] subjectAltName=IP:172.25.11.11
To create a private certificate authority, and then generate and sign a client certificate for TLS use a Juniper-related services like NETCONF/gRPC:
openssl genrsa -out clientRootCA.key 4096 openssl req -new -x509 -sha256 -key clientRootCA.key -out clientRootCA.crt -days 3650 -subj "/C=US/ST=CA/L=Sunnyvale/O=Juniper/CN=clientRootCA" openssl genrsa -out client.key 4096 openssl req -new -key client.key -out client.csr -sha256 -subj "/C=US/ST=CA/L=Sunnyvale/O=Juniper/OU=serverRootCAOrg/CN= client-desktop" openssl x509 -req -in client.csr -CA clientRootCA.crt -CAkey clientRootCA.key -CAcreateserial -out client.crt -days 365 -extfile server_ssl_cert_ext.cnf
-
set system services http servers server grpc-server port 32767 set system services http servers server grpc-server grpc gnoi set system services http servers server grpc-server grpc gnmi set system services http servers server grpc-server tls local-certificate grpc-server
To configure mutual authentication instead of server-only authentication:
set system services extension-service request-response grpc ssl port 32767 set system services extension-service request-response grpc ssl local-certificate grpc-server
To configure authentication for the gRPC client directly (in the network device configuration):
set system services extension-service request-response grpc ssl mutual-authentication certificate-authority grpc-client-CA set system services extension-service request-response grpc ssl mutual-authentication client-certificate-request require-certificate-and-verify set system services extension-service request-response grpc ssl hot-reloading set system services extension-service request-response grpc ssl use-pki set system services extension-service traceoptions file jsd set system services extension-service traceoptions flag all set security pki ca-profile grpc-client-CA ca-identity clientRootCA set security pki traceoptions file size 10m set security pki traceoptions file files 3
To copy the certificates that you have generated on the client to the gRPC server:
scp -O server.crt lab@172.25.11.11:/var/home/lab scp -O server.key lab@172.25.11.11:/var/home/lab scp -O clientRootCA.crt lab@172.25.11.11:/var/home/lab
To load the certificate on the server:
request security pki local-certificate load certificate-id grpc-server filename /var/home/lab/server.crt key /var/home/lab/server.key request security pki ca-certificate load ca-profile grpc-client-CA filename /var/home/lab/client.crt
To configure the user account for gRPC services:
set system login user gnoi-user class super-user set system login user gnoi-user authentication plain-text-password set system login user gnoi-user full-name "gNOI client"
Identify the information that you want to receive from the QFX Series switch. Information you want to stream through Junos telemetry is specified using a telemetry sensor path. A telemetry sensor path is the hierarchical path (defined using YANG) to the operational data or metrics to be monitored.
For example, the following sensor path streams administrative and operational status information for interfaces on the device:
/junos/system/linecard/interface
For more information about telemetry sensor paths, see Explore Sensor Paths. To view all the supported sensor paths, their corresponding leaf nodes, and the device platforms, see Junos YANG Data Model Explorer.
Download, install, and configure the gNMI client to test the telemetry streaming on your QFX Series switch. Junos OS Evolved-based devices support various subscription types. See Subscription Types and subscription mode to identify the subscription type and mode for your network.
To test the telemetry streaming on your Linux machine and subscribe to telemetry data using the gNMI client:
gnmic sub -a <device_ip>:<gnmi_port> -u <username> -p <password> --format json subscribe --path <sensor path> --mode stream --stream-mode sample --sample-interval <seconds>
where,
format: Specifies the output format used by the gNMI client to display telemetry data. Thejsonformat presents telemetry data in JSON. Available options include JSON, BYTES, PROTO, ASCII, and JSON_IETF.sub: Invokes the gNMI subscribe RPC to establish a telemetry subscription with the device.path: Is the YANG sensor path to stream telemetry data.mode: Defines the subscription mode. The stream mode establishes a continuous subscription that sends telemetry updates over time.stream-mode: Specifies the streaming behavior for a stream subscription. The sample mode sends updates at regular intervals.sample-interval: Sets the sampling interval for stream subscriptions whenstream-modesample is configured.
In the following example, "stream" is selected as subscription type and "sample" as subscription mode.
gnmic sub -a 172.25.11.11:32767 -u gnoi-user -p gnoi123 --tls-ca serverRootCA.crt --tls-cert client.crt --tls-key client.key --format json subscribe --path /junos/system/linecard/interface --mode stream --stream-mode sample --sample-interval 10s
Verify that the telemetry data is received on the collector. A successful output confirms that the gNMI connection is established and the telemetry data is streaming from the QFX Series switch.
Sample gNMI Telemetry Output (JSON format)
{ "source": "172.25.11.11:32767", "subscription-name": "default-1782391912", "timestamp": 1782391912042548677, "time": "2026-06-25T05:51:52.042548677-07:00", "prefix": "interfaces/interface[name=et-0/0/0]", "updates": [ { "Path": "name", "values": { "name": "et-0/0/0" } }, { "Path": "state/hardware-port", "values": { "state/hardware-port": "FPC0:PIC0:PORT0" } }, { "Path": "state/transceiver", "values": { "state/transceiver": "FPC0:PIC0:PORT0:Xcvr0" } }, { "Path": "state/physical-channel", "values": { "state/physical-channel": { "element": [ { "Value": { "JsonVal": "MA==" } }, { "Value": { "JsonVal": "MQ==" } }, { "Value": { "JsonVal": "Mg==" } }, { "Value": { "JsonVal": "Mw==" } } ] } } }, { "Path": "name", "values": { "name": "et-0/0/1" } }, { "Path": "state/hardware-port", "values": { "state/hardware-port": "FPC0:PIC0:PORT1" } }, { "Path": "state/transceiver", "values": { "state/transceiver": "FPC0:PIC0:PORT1:Xcvr0" } }, { "Path": "state/physical-channel", "values": { "state/physical-channel": { "element": [ { "Value": { "JsonVal": "MA==" } }, { "Value": { "JsonVal": "MQ==" } }, { "Value": { "JsonVal": "Mg==" } }, { "Value": { "JsonVal": "Mw==" } } ] } } }, … truncatedA continuous stream of telemetry data indicates that gNMI telemetry streaming is operating correctly on the QFX Series switches.
After verifying your telemetry setup, install one of the many available open-source or third-party collectors.
Note:Setup and configuration of these collectors is beyond the scope of this guide.