Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

 
ON THIS PAGE
 

Logging, SNMP, and Telemetry

Learn how to enable system logging, SNMP, and Telemetry services on the SRX1600, SRX4120, and SRX4300 Firewalls.

After you have completed the system configuration of user accounts and authentication methods, you can enable system logging, SNMP, and telemetry on the device.

The SRX1600, SRX4120, and SRX4300 Firewalls baseline configurations for logging, SNMP, and telemetry involve enabling essential logging for security events and system messages, basic SNMP for monitoring, and telemetry streaming for advanced analytics. This topic provides you the recommended minimal configurations.

Logging (Syslog and Security Logs)

System Logs

Syslog and event logging ensure visibility into allowed or blocked flows, firewall health, and security events.

You can configure system logging to record system events, track configuration changes, and troubleshoot issues.

Basic logging captures system events, audit logs, and security policy actions. Start with local archiving and optional forwarding to a remote server.

The following configuration enables local system log archiving on the Routing Engine and configures security logs generated in the data plane to be forwarded to the Routing Engine:

For log traffic information for a specific policy, see log (Security Policies).

Verify the logs configured:

Security Logs

For security logs on your firewall, use the set security log mode stream command to send logs directly from the data plane to a remote syslog server through the revenue ports, preventing overload on the Routing Engine.

  • Stream Mode—mode stream streams logs directly to external servers (example: set security log stream <name> host <IP>), ideal for high volume as it bypasses Routing Engine processing.
  • Event Mode—mode event or stream-event sends logs to the Routing Engine first, which can overwhelm the Routing Engine under high traffic; use set security log event-rate <limit> (example: 1500) to throttle.

Use the set security log mode stream and set security log report commands for on-box reporting to external servers. Stream mode supports UDP, TCP, and TLS protocols for secure transmission. You can configure up to eight remote hosts to receive security logs simultaneously, providing redundancy and load distribution.

Best Practices

  • Use revenue ports rather than the fxp0 management interface to route traffic to the syslog server.
  • Supported log formats include binary (compact, for JSA or STRM), sd-syslog (structured syslog), syslog, protobuf, and welf.
  • Example for TLS-secured stream:
  • SDC or Cloud Logs: stream sd-cloud-logs requires a valid log plan in Security Director Cloud (SDC).
  • Limits: A maximum of eight log streams is supported. In a multitenant setup, configure log streams separately for each tenant.

SNMP

SNMP provides device monitoring through MIBs.

The following baseline configuration enables basic SNMP monitoring on the firewall by configuring a read-only community access, trap forwarding to a network management system (NMS), device identification (DevID) information, and SNMPv2c monitoring. For enhanced security, you can use SNMPv3 instead of SNMPv2c.

You can verify the SNMP configuration using the show snmp statistics command.

Telemetry

The SRX1600, SRX4120, and SRX4300 Firewalls support Junos telemetry for monitoring network performance, security events, application management, and network capacity planning. For more information about Junos telemetry, see Understanding Junos Telemetry.

Junos Telemetry enables you to stream device data from devices to external data collectors, providing insights into traffic patterns, device status, error rates, and overall network health. The data is streamed over gRPC connections, which can be initiated either from the device or an external collector. These firewalls support telemetry for tracking short-duration traffic bursts (not microbursts) on operational physical interfaces, using millisecond-level sampling and exporting the data through streaming telemetry (gRPC). This functionality is provisioned through telemetry sensor subscriptions rather than traditional CLI configuration.

You can explore and compare various OpenConfig and Native data model (DM) attributes of Junos telemetry using Junos YANG Data Model Explorer. This application enables you to view all the supported resource paths, the corresponding leaf devices, and the devices that support the resource paths. You can filter results based on software release or product to identify available telemetry sensors on each platform.

To enable any telemetry feature, you need to ensure that:

  • Junos telemetry is available.

  • gRPC service is available.

Configure gRPC for Junos Telemetry Interface

To configure your device for gRPC services, specify the API connection setting based on Secure Sockets Layer (SSL) technology, and then specify a local-certificate name. For example:

In the first command shown in this example, extension-service request-response grpc enables the gRPC interface under the extension service framework, used for APIs such as Junos telemetry or third-party integrations. The client issues a request and waits for a response from the Junos OS server.

Verify gRPC Configuration

To verify gRPC configuration, run the following command on all the leaf-and-spine node devices:

To validate connectivity between the telemetry collectors:

To verify that the collectors are actively pulling data through gRPC/gNMI:

To verify the status of sensors: