SRX

Expand all | Collapse all

tcp Syslog -- Supported?

  • 1.  tcp Syslog -- Supported?

    Posted 07-12-2012 16:19

    Hi All,

     

    Is sending syslog from High End SRX (Data plane and Control Plane) supported over TCP instead of UDP.  It would be preferable for ensured delivery of logs.

     

     

    Thanks!



  • 2.  RE: tcp Syslog -- Supported?

    Posted 07-13-2012 03:20

    I think TCP version of syslog is not supported by JunOS on HE devices. I have used tcp syslog feature supported Cisco ISO using catalyst switches and also used it on ScreenOS.

     

    syslog config "10.10.10.10" transport

    However, a workaround can be a syslong-ng machine (which support tcp syslogging) working as Syslog gateway, transforming UDP Syslog to TCP Syslog; i.e.


    SRX -----<trust>--------- Syslog-ng ------<untrust>------ NMS

    kind regards



  • 3.  RE: tcp Syslog -- Supported?

    Posted 03-18-2019 02:30

    I had the same question. Looks like Junos does not support TCP for system syslog, but supports TCP for security syslog only, see https://www.juniper.net/documentation/en_US/junos/topics/reference/configuration-statement/transport-edit-security-log.html (seems to have some TLS support there as well): set security log transport protocol tcp. For the TCP I tried it, it seems to send the messages in some run-lenght encoded format (you could e.g. do a tcpdump/wireshark capure at the receiving end). It did not work with our use-case (sending the SRX syslogs to fluent-bit, as fluent-bit is not prepared to process this RLE format. I am not a syslog expert and does not have time to read syslog RFC-s, and implement changes to fluent-bit to be able to use the "Junos TCP format" (whether it is standard or not), so I fell back to UDP also for the security syslog for now.



  • 4.  RE: tcp Syslog -- Supported?

     
    Posted 03-18-2019 03:17

    Hello 

     

    From your post, I understand that you for got the tcp format working for security syslog but the format is not suitable.

     

    Can you check if fluent-bit can process the streams in any of these formats?

    https://kb.juniper.net/InfoCenter/index?page=content&id=KB28508&cat=SRX_SERIES&actp=LIST

     

    Regards,

     

    Vikas