SRX

Hi, guys,

Issue found on traceoption on physical interfaces of SRX345 ( JUNOS 15.1X49-D110.4 built 2017-09-08 ).

I want to record/capture the event log of physical interface status, so the following configuration is set up:

        set interfaces traceoptions file interface_status.txt
        set interfaces traceoptions file size 10m
        set interfaces traceoptions file files 24
        set interfaces traceoptions file world-readable
       set interfaces traceoptions flag config-states
       commit and-quit

Strangely, interface event status could not be found in "/var/log/interface_status.txt", but found in "/var/log/messages",

any issue/advice, thx ?

Also, any recommended configuration to traceoption the event log logical physical, such as GRE interface of "gr-0/0/0.10" ?

Interface status in "Messages" :

root@labtest-fw2% cat messages
Nov 15 07:00:00 labtest-fw2 newsyslog[25618]: logfile turned over due to size>100K
Nov 15 07:02:14 labtest-fw2 mib2d[1713]: SNMP_TRAP_LINK_DOWN: ifIndex 519, ifAdminStatus up(1), ifOperStatus down(2), ifName ge-0/0/7
Nov 15 07:02:14 labtest-fw2 mib2d[1713]: SNMP_TRAP_LINK_DOWN: ifIndex 545, ifAdminStatus up(1), ifOperStatus down(2), ifName irb.733
Nov 15 07:12:29 labtest-fw2 mib2d[1713]: SNMP_TRAP_LINK_DOWN: ifIndex 519, ifAdminStatus up(1), ifOperStatus down(2), ifName ge-0/0/7
Nov 15 07:12:29 labtest-fw2 mib2d[1713]: SNMP_TRAP_LINK_DOWN: ifIndex 545, ifAdminStatus up(1), ifOperStatus down(2), ifName irb.733
Nov 15 07:12:43 labtest-fw2 mib2d[1713]: SNMP_TRAP_LINK_DOWN: ifIndex 512, ifAdminStatus up(1), ifOperStatus down(2), ifName ge-0/0/1
Nov 15 07:12:43 labtest-fw2 mib2d[1713]: SNMP_TRAP_LINK_DOWN: ifIndex 554, ifAdminStatus up(1), ifOperStatus down(2), ifName gr-0/0/0.40
Nov 15 07:12:44 labtest-fw2 rmopd[1718]: RMOPD_ICMP_SENDMSG_FAILURE: sendmsg(ICMP): Network is down

How to configure the interface traceoption for recording these messages in the traceoption file "interface.txt" ?

Hi Ben Ben,

Based on my personal experience Interface Traceoptions doesnt show the information you are looking for (interface flaps). I have tried them in the past and I was never able to get any useful info from those traces.

I just tried configure them and it is still the same situation:

[edit]
root@jtac-SRX320-r006# show interfaces traceoptions
file INT_TRACES size 1g;

[edit]
root@jtac-SRX320-r006# show interfaces ge-0/0/2
traceoptions {
    flag all;
}

Results:

Disabled Interface ge-0/0/2:

Nov 20 14:00:38 jtac-SRX320-r006 clear-log[19183]: logfile cleared
Nov 20 14:01:03.110487 1846 dcd_ui.c:950 dcd_commit_check() INFO :  Created child process with pid 19208
Nov 20 14:01:03.153954 1846 dcd.c:3233 run_daemon() INFO : Received SIGCHLD, collecting zombies.
Nov 20 14:01:03.154072 1846 dcd.c:3237 run_daemon() INFO :  Child with pid 19208 exited
Nov 20 14:01:09.448646 1846 dcd.c:3246 run_daemon() INFO : Received SIGHUP, time to reparse.
Nov 20 14:01:16.209698 1846 dcd.c:3019 run_daemon() INFO : Pending config request now being serviced
Nov 20 14:01:20.770981 1846 usage.c:75 dcd_trace_times() INFO :     Phase Usage for IDLE                : user 0.000 s, sys 0.050 s, wall 194.314 s
Nov 20 14:01:20.771789 1846 dcd.c:726 dcd_new_phase() INFO : New phase is PRE_CONFIG
Nov 20 14:01:20.771852 1846 usage.c:75 dcd_trace_times() INFO :         Static Config Read time measurements for dep delete : user 0.000 s, sys 0.000 s, wall 0.000 s
Nov 20 14:01:20.771897 1846 usage.c:75 dcd_trace_times() INFO :         Static config read usage        : user 0.000 s, sys 0.029 s, wall 4.562 s
Nov 20 14:01:20.772133 1846 usage.c:75 dcd_trace_times() INFO :     Phase Usage for PRE_CONFIG          : user 0.000 s, sys 0.000 s, wall 0.000 s
Nov 20 14:01:20.772184 1846 dcd.c:726 dcd_new_phase() INFO : New phase is CONFIG
Nov 20 14:01:20.775111 1846 usage.c:75 dcd_trace_times() INFO :         Config db overlay usage         : user 0.000 s, sys 0.002 s, wall 0.002 s
Nov 20 14:01:20.775250 1846 dcd.c:871 dcd_new_phase() INFO : dcd_new_phase:recover_type = 1, dcd_is_protocol_master = 1,sdb_state = 2,run_dynamic_db_diff = 0
Nov 20 14:01:20.775303 1846 dcd.c:878 dcd_new_phase() INFO : dcd_new_phase - Running db_diff on static db
Nov 20 14:01:20.781069 1846 usage.c:75 dcd_trace_times() INFO :         Config static db diff usage     : user 0.000 s, sys 0.005 s, wall 0.005 s
Nov 20 14:01:20.874804 1846 usage.c:75 dcd_trace_times() INFO :         Config sync io                  : user 0.000 s, sys 0.016 s, wall 0.093 s
Nov 20 14:01:20.876398 1846 usage.c:75 dcd_trace_times() INFO :         Config depenency cleanup usage  : user 0.000 s, sys 0.000 s, wall 0.000 s
Nov 20 14:01:20.876506 1846 usage.c:75 dcd_trace_times() INFO :     Phase Usage for CONFIG              : user 0.000 s, sys 0.025 s, wall 0.104 s
Nov 20 14:01:20.876548 1846 dcd.c:726 dcd_new_phase() INFO : New phase is IDLE
Nov 20 14:01:20.881388 1846 dcd.c:3153 run_daemon() INFO : Going idle, 11 sync writes, 9 sync reads, 9 ifstate msgs, 9 ifstate reads, 9 async ifd msgs, 0 async rtb msgs,  0 async bd msgs, 0 async mesh group msgs, 109287 usec

Enabled interface ge-0/0/2:

Nov 20 14:03:04 jtac-SRX320-r006 clear-log[19251]: logfile cleared
Nov 20 14:03:14.020567 1846 dcd_ui.c:950 dcd_commit_check() INFO :  Created child process with pid 19272
Nov 20 14:03:14.063730 1846 dcd.c:3233 run_daemon() INFO : Received SIGCHLD, collecting zombies.
Nov 20 14:03:14.064447 1846 dcd.c:3237 run_daemon() INFO :  Child with pid 19272 exited
Nov 20 14:03:20.434990 1846 dcd.c:3246 run_daemon() INFO : Received SIGHUP, time to reparse.
Nov 20 14:03:27.179766 1846 dcd.c:3019 run_daemon() INFO : Pending config request now being serviced
Nov 20 14:03:32.917698 1846 usage.c:75 dcd_trace_times() INFO :     Phase Usage for IDLE                : user 0.000 s, sys 0.045 s, wall 132.041 s
Nov 20 14:03:32.920608 1846 dcd.c:726 dcd_new_phase() INFO : New phase is PRE_CONFIG
Nov 20 14:03:32.920676 1846 usage.c:75 dcd_trace_times() INFO :         Static Config Read time measurements for dep delete : user 0.000 s, sys 0.000 s, wall 0.000 s
Nov 20 14:03:32.920722 1846 usage.c:75 dcd_trace_times() INFO :         Static config read usage        : user 0.000 s, sys 0.030 s, wall 5.740 s
Nov 20 14:03:32.922894 1846 usage.c:75 dcd_trace_times() INFO :     Phase Usage for PRE_CONFIG          : user 0.000 s, sys 0.000 s, wall 0.002 s
Nov 20 14:03:32.922971 1846 dcd.c:726 dcd_new_phase() INFO : New phase is CONFIG
Nov 20 14:03:32.929770 1846 usage.c:75 dcd_trace_times() INFO :         Config db overlay usage         : user 0.000 s, sys 0.002 s, wall 0.006 s
Nov 20 14:03:32.932002 1846 dcd.c:871 dcd_new_phase() INFO : dcd_new_phase:recover_type = 1, dcd_is_protocol_master = 1,sdb_state = 2,run_dynamic_db_diff = 0
Nov 20 14:03:32.932088 1846 dcd.c:878 dcd_new_phase() INFO : dcd_new_phase - Running db_diff on static db
Nov 20 14:03:32.945491 1846 usage.c:75 dcd_trace_times() INFO :         Config static db diff usage     : user 0.000 s, sys 0.005 s, wall 0.013 s
Nov 20 14:03:33.061790 1846 usage.c:75 dcd_trace_times() INFO :         Config sync io                  : user 0.000 s, sys 0.017 s, wall 0.116 s
Nov 20 14:03:33.061897 1846 usage.c:75 dcd_trace_times() INFO :         Config depenency cleanup usage  : user 0.000 s, sys 0.000 s, wall 0.000 s
Nov 20 14:03:33.062003 1846 usage.c:75 dcd_trace_times() INFO :     Phase Usage for CONFIG              : user 0.000 s, sys 0.025 s, wall 0.139 s
Nov 20 14:03:33.062043 1846 dcd.c:726 dcd_new_phase() INFO : New phase is IDLE
Nov 20 14:03:33.067841 1846 dcd.c:3153 run_daemon() INFO : Going idle, 11 sync writes, 9 sync reads, 9 ifstate msgs, 9 ifstate reads, 9 async ifd msgs, 0 async rtb msgs,  0 async bd msgs, 0 async mesh group msgs, 145001 usec

In both scenarios the same type of logs were generated and didnt show much information. Im using a SRX230 running 15.1X49-D180.

My suggestion will be to create a syslog file where you can log only interface flaps:

# set system syslog file INT_FLAPS any any
# set system syslog file INT_FLAPS match (SNMP_TRAP_LINK_DOWN|SNMP_TRAP_LINK_UP)

Hope this helps you.

Hi, MROJAS,

Your suggestion may be a solution, if the file "INT_FLAPS" is just a copy of system syslog file, but not move the wanted messages from system syslog, how to achieve this ?

We want to keep the whole system syslog file sending to syslog server; and just copy the wanted messages to the file "INT_FLAPS".

Thanks a lot