Discussion

Solution
Use the following commands to save all log messages to a file called messages:
[edit]
aviva@router1# set system syslog file messages any info
Discussion
The most common place to save system logging messages is on the router. If you do
not configure logging, it is turned on by default and sends messages to the file
messages (located in /var/log on M-series and T-series routers and in /cf/var/log on J-
series routers). The messages logged are those from all facilities that have a severity
notice and all authorization messages. If you were to configure the default settings,
the configuration file would look like this:
[edit system syslog]
file messages {
any notice;
authorization info;
}
This recipe modifies the default so messages from all facilities (any) and all severities
(info) are logged. Keep in mind that for a given severity level, the software logs all
messages at that level and at all more serious levels, so when you specify the lowest
severity level, info, you are in effect recording all system log messages except for
debug messages. You could also specify any instead of info here.
When you want to review the system log messages, use the show log command. In all
system log message files, the messages are listed in order, from oldest to newest. As
the file gets large, you have to scroll through a lot of lines to get to the most recent
messages. You can shorten the output by using some of the CLI command filters. For
example, you can specify today’s date and time to list only the most recent messages
(match is simply the Unix grep utility):
aviva@router1> show log messages | match "Mar 9 11:5"
Mar 9 11:54:31 router1 login: LOGIN_INFORMATION: User aviva logged in from host
172.17.28.19 on device ttyp1
Mar 9 11:54:34 router1 mgd[29108]: UI_DBASE_LOGIN_EVENT: User 'aviva' entering
configuration mode
Mar 9 11:56:13 router1 mgd[29108]: UI_DBASE_LOGOUT_EVENT: User 'aviva' exiting
configuration mode
Mar 9 11:57:52 router1 mgd[28332]: UI_DBASE_LOGOUT_EVENT: User 'aviva' exiting
configuration mode
If you want to find out who has logged in to the router today, you can set up a chain
of filters:
aviva@router1> show log messages | match LOGIN | match "Mar 16"
Mar 16 11:00:53 router1 login: LOGIN_INVALID_LOCAL_USER: No entry in local password
file for user pwd
This is the Title of the Book, eMatter Edition
Copyright © 2008 O’Reilly & Associates, Inc. All rights reserved.
Turning On Logging | 165