I suggest stream logging: https://www.juniper.net/documentation/en_US/junos/topics/task/configuration/security-system-stream-security-log-revenue-port-setting.html
We use this on every SRX we have for traffic logging. Regards Mike > On 19 Jun 2017, at 21:45, Aaron Gould <aar...@gvtc.com> wrote: > > I'm trying to send SRX240 traffic/session logs to a syslog server... i have > some system messages going to the syslog server, but not the session/traffic > logs. What do i need to do ? > > > > ....i'll show you some info from the syslog stanza....let me know if you > need to see anything else... > > > > {primary:node0} > > aaron.gould@HQ_A> show configuration system syslog | display set > > set system syslog host 10.51.16.9 any any > > set system syslog file policy_session user info > > set system syslog file policy_session match RT_FLOW > > set system syslog file policy_session archive size 5120000 > > set system syslog file policy_session archive files 5 > > set system syslog file policy_session archive world-readable > > set system syslog file policy_session structured-data > > set system syslog file traffic-log any any > > set system syslog file traffic-log match RT_FLOW_SESSION > > set system syslog file traffic-log archive size 5120000 > > set system syslog file traffic-log archive files 5 > > set system syslog file traffic-log archive world-readable > > set system syslog file traffic-log structured-data > > set system syslog source-address 1.2.3.4 > > > > {primary:node0} > > > > **** these messages are seen on the syslog server at 1.2.3.4 > > > > Jun 19 14:37:15 HQ_A HQ_A nh_walk_chek_max_num_tag: unexpected NH type 17 > > Jun 19 14:37:15 HQ_A HQ_A nh_walk_chek_max_num_tag: unexpected NH type 17 > > Jun 19 14:37:15 HQ_A HQ_A nh_walk_chek_max_num_tag: unexpected NH type 17 > > Jun 19 14:37:20 HQ_A HQ_A nh_walk_chek_max_num_tag: unexpected NH type 17 > > Jun 19 14:37:25 HQ_A HQ_A nh_walk_chek_max_num_tag: unexpected NH type 17 > > Jun 19 14:37:25 HQ_A last message repeated 4 times > > Jun 19 14:37:25 HQ_A HQ_A nh_walk_chek_max_num_tag: unexpected NH type 17 > > Jun 19 14:37:29 HQ_A HQ_A nh_walk_chek_max_num_tag: unexpected NH type 17 > > Jun 19 14:37:30 HQ_A mgd[9666]: UI_CMDLINE_READ_LINE: User 'aaron.gould', > command 'show configuration system syslog | display set ' > > Jun 19 14:37:30 HQ_A HQ_A nh_walk_chek_max_num_tag: unexpected NH type 17 > > Jun 19 14:37:32 HQ_A HQ_A nh_walk_chek_max_num_tag: unexpected NH type 17 > > Jun 19 14:37:38 HQ_A HQ_A nh_walk_chek_max_num_tag: unexpected NH type 17 > > Jun 19 14:37:38 HQ_A last message repeated 4 times > > Jun 19 14:37:41 HQ_A HQ_A nh_walk_chek_max_num_tag: unexpected NH type 17 > > Jun 19 14:37:41 HQ_A last message repeated 4 times > > Jun 19 14:37:48 HQ_A HQ_A nh_walk_chek_max_num_tag: unexpected NH type 17 > > Jun 19 14:37:48 HQ_A last message repeated 2 times > > Jun 19 14:37:48 HQ_A HQ_A nh_walk_chek_max_num_tag: unexpected NH type 17 > > Jun 19 14:37:48 HQ_A HQ_A nh_walk_chek_max_num_tag: unexpected NH type 17 > > > > > > ***** these are the local flows seen in the SRX240 cli that I would like to > see on the syslog server.... > > > > {primary:node0} > > aaron.gould@HQ_A> show security flow session > > node0: > > -------------------------------------------------------------------------- > > > > Session ID: 216, Policy name: LAN_22bit_Browsing/9, State: Active, Timeout: > 1794, Valid > > In: 10.0.2.165/61141 --> 52.112.66.235/443;tcp, If: reth0.0, Pkts: 2666, > Bytes: 463076 > > Out: 52.112.66.235/443 --> 2.4.6.8/62085;tcp, If: reth1.0, Pkts: 2736, > Bytes: 1048146 > > > > Session ID: 248, Policy name: LAN_22bit_Browsing/9, State: Active, Timeout: > 1772, Valid > > In: 10.0.3.116/57591 --> 65.52.108.227/443;tcp, If: reth0.0, Pkts: 8177, > Bytes: 805754 > > Out: 65.52.108.227/443 --> 2.4.6.8/54704;tcp, If: reth1.0, Pkts: 4105, > Bytes: 775308 > > > > Session ID: 253, Policy name: LAN_22bit_Browsing/9, State: Active, Timeout: > 1716, Valid > > In: 10.0.2.165/51076 --> 216.58.194.78/443;tcp, If: reth0.0, Pkts: 13, > Bytes: 3632 > > Out: 216.58.194.78/443 --> 2.4.6.8/55637;tcp, If: reth1.0, Pkts: 14, > Bytes: 1489 > > > > Session ID: 303, Policy name: LAN_22bit_Browsing/9, State: Active, Timeout: > 1784, Valid > > In: 10.0.2.72/51189 --> 52.112.66.235/443;tcp, If: reth0.0, Pkts: 5040, > Bytes: 999840 > > Out: 52.112.66.235/443 --> 2.4.6.8/57607;tcp, If: reth1.0, Pkts: 5393, > Bytes: 2466530 > > > > > > > > _______________________________________________ > juniper-nsp mailing list juniper-nsp@puck.nether.net > https://urldefense.proofpoint.com/v2/url?u=https-3A__puck.nether.net_mailman_listinfo_juniper-2Dnsp&d=DwICAg&c=wBUwXtM9sKhff6UeHOQgvw&r=iCARHrCSMVMu5fNENyuQGdvoQJpwI5WIbiqe9jFEMFg&m=QQkoyObLu_PafLl0X_os-t1n10Kdpf7aDFA8iqsS4kg&s=Bh5Xu6_cNyroV2et5G7CnoOTBx6xRWe-DxgQBO8uZFw&e= > _______________________________________________ juniper-nsp mailing list juniper-nsp@puck.nether.net https://puck.nether.net/mailman/listinfo/juniper-nsp