Discussion

Discussion
This configuration redirects all logging messages to the file server 172.17.12.30. You
can also specify the hostname instead of the IP address. The file server must be running
a standard syslogd utility. You find the system logging messages in the /var/log/
messages file on the server, unless the server has been configured to save them someplace
else:
aviva-server1%: tail /var/log/messages
Mar 23 09:27:29 server1 /kernel: linux: syscall mmap2 is obsoleted or not implemented
(pid=12624)
%INTERACT-5-UI_DBASE_LOGIN_EVENT: User 'aviva' entering configuration mode
Mar 23 17:48:40 router1-fxp0.mycompany mgd[4098]: %INTERACT-5-UI_COMMIT: User 'aviva'
performed commit: no comment
Mar 23 17:48:44 router1-fxp0.mycompany xntpd[4860]: %NTP-5: ntpd 4.0.99b Sat Mar 12
07:43:39 GMT 2005 (1)
Mar 23 17:48:44 router1-fxp0.mycompany xntpd[4860]: %NTP-5: using kernel phase-lock
loop 2001
Mar 23 17:48:44 router1-fxp0.mycompany xntpd[4860]: %NTP-5: using kernel phase-lock
loop 2041
Mar 23 17:48:45 router1-fxp0.mycompany mgd[4098]: %INTERACT-5-UI_DBASE_LOGOUT_EVENT:
User 'aviva' exiting configuration mode
The output shows both the server’s and the router’s logging messages intermixed in
the logging file. You can identify the messages from the router because the field after
the timestamp identifies the router by IP address and router port or, if the server can
resolve the IP address, by its DNS name. The router messages in this output show
router1-fxp0.mycompany. The router name is router1, and the messages were sent to
the log server over port (or interface) fxp0, which is the router’s out-of-band management
interface. The JUNOS software has a tendency to send logging messages out
the interface with the shortest path to the syslog server. This can cause all sorts of
problems, depending on how your log server and firewall filters are set up. To circumvent
these problems, specifically include the interface from which to send the
messages:
[edit system syslog]
aviva@router1# set source-address 192.168.15.42/32
This command sets the messages to go out 192.168.15.42, which is the router’s loopback
address. You normally use the router’s loopback address when sending system
logging messages, but you can use any interface dedicated to management. With this
configuration, logging messages from the router will include the resolved hostname
of the IP address for lo0 (for example, lo.router1.mycompany.com) rather than showing
router1-fxp0.mycompany.
Sometimes you want to have more information to identify the source of the message
than just the router name. You can specify a text string that is also included in the
logging message:
[edit system syslog]
Sending Logging Messages to a Log Server | 173
This is the Title of the Book, eMatter Edition
Copyright © 2008 O’Reilly & Associates, Inc. All rights reserved.