SRX

Hi everyone

￭ Chassis Model : SRX340
￭ OS Version : 21.4R3-S5.4

I want to use srx340 ssd on-box to store traffic flow.

The SSD is mounted successfully as shown below.

root@FW> show system storage detail 
Filesystem 1024-blocks Used Avail Capacity Mounted on
/dev/da0s2a 600594 430014 122534 78% /
devfs 1 1 0 100% /dev
/dev/md0 20012 12416 5996 67% /junos
/cf/packages 600594 430014 122534 78% /junos/cf/packages
devfs 1 1 0 100% /junos/cf/dev
/dev/md1 1458820 1458820 0 100% /junos
/cf 20012 12416 5996 67% /junos/cf
devfs 1 1 0 100% /junos/dev/
/cf/packages 600594 430014 122534 78% /junos/cf/packages1
procfs 4 4 0 100% /proc
/dev/bo0s3e 189432 54 174224 0% /config
/dev/bo0s3f 5169908 420800 4335516 9% /cf/var
/dev/md2 1056324 112614 859206 12% /mfs
/cf/var/jail 5169908 420800 4335516 9% /jail/var
/cf/var/jails/rest-api 5169908 420800 4335516 9% /web-api/var
devfs 1 1 0 100% /jail/dev
/dev/md3 1884 4 1730 0% /jail/mfs
/dev/ssd 96138198 6 88447138 0% /var/ssd

I configured the following

set security log mode stream
set security log file name traffic-log
set security log file path /var/ssd/traffic-log/

set system syslog file traffic-log any any
set system syslog file traffic-log match RT_FLOW_SESSION

The policy sets log session-init /log session-close and flow session also exists.

However, the file is not created in the /var/ssd/traffic-log/ directory.

Please tell me how to save traffic flow using srx340 ssd on-box.

Please help Juniper experts...

------------------------------
minho kim
------------------------------

Hello!

Please run file list /mfs/var/ detail to see if the device properly linked the traffic-log folder for /var/ssd/traffic-log.
Reference: https://www.juniper.net/documentation/us/en/hardware/srx340/topics/task/ssd-installation-srx340-srx345.html

Also, for on-box logging you should use security log mode event.
Reference: https://www.juniper.net/documentation/us/en/software/junos/network-mgmt/topics/topic-map/system-logging-for-a-security-device.html#id-configuring-on-box-binary-security-log-files

Hi everyone

￭ Chassis Model : SRX340
￭ OS Version : 21.4R3-S5.4

I want to use srx340 ssd on-box to store traffic flow.

The SSD is mounted successfully as shown below.

root@FW> show system storage detail 
Filesystem 1024-blocks Used Avail Capacity Mounted on
/dev/da0s2a 600594 430014 122534 78% /
devfs 1 1 0 100% /dev
/dev/md0 20012 12416 5996 67% /junos
/cf/packages 600594 430014 122534 78% /junos/cf/packages
devfs 1 1 0 100% /junos/cf/dev
/dev/md1 1458820 1458820 0 100% /junos
/cf 20012 12416 5996 67% /junos/cf
devfs 1 1 0 100% /junos/dev/
/cf/packages 600594 430014 122534 78% /junos/cf/packages1
procfs 4 4 0 100% /proc
/dev/bo0s3e 189432 54 174224 0% /config
/dev/bo0s3f 5169908 420800 4335516 9% /cf/var
/dev/md2 1056324 112614 859206 12% /mfs
/cf/var/jail 5169908 420800 4335516 9% /jail/var
/cf/var/jails/rest-api 5169908 420800 4335516 9% /web-api/var
devfs 1 1 0 100% /jail/dev
/dev/md3 1884 4 1730 0% /jail/mfs
/dev/ssd 96138198 6 88447138 0% /var/ssd

I configured the following

set security log mode stream
set security log file name traffic-log
set security log file path /var/ssd/traffic-log/

set system syslog file traffic-log any any
set system syslog file traffic-log match RT_FLOW_SESSION

The policy sets log session-init /log session-close and flow session also exists.

However, the file is not created in the /var/ssd/traffic-log/ directory.

Please tell me how to save traffic flow using srx340 ssd on-box.

Please help Juniper experts...

------------------------------
minho kim
------------------------------

I'll try it and let you know the results.

Thank you

Hello!

Please run file list /mfs/var/ detail to see if the device properly linked the traffic-log folder for /var/ssd/traffic-log.
Reference: https://www.juniper.net/documentation/us/en/hardware/srx340/topics/task/ssd-installation-srx340-srx345.html

Also, for on-box logging you should use security log mode event.
Reference: https://www.juniper.net/documentation/us/en/software/junos/network-mgmt/topics/topic-map/system-logging-for-a-security-device.html#id-configuring-on-box-binary-security-log-files

Hi everyone

￭ Chassis Model : SRX340
￭ OS Version : 21.4R3-S5.4

I want to use srx340 ssd on-box to store traffic flow.

The SSD is mounted successfully as shown below.

root@FW> show system storage detail 
Filesystem 1024-blocks Used Avail Capacity Mounted on
/dev/da0s2a 600594 430014 122534 78% /
devfs 1 1 0 100% /dev
/dev/md0 20012 12416 5996 67% /junos
/cf/packages 600594 430014 122534 78% /junos/cf/packages
devfs 1 1 0 100% /junos/cf/dev
/dev/md1 1458820 1458820 0 100% /junos
/cf 20012 12416 5996 67% /junos/cf
devfs 1 1 0 100% /junos/dev/
/cf/packages 600594 430014 122534 78% /junos/cf/packages1
procfs 4 4 0 100% /proc
/dev/bo0s3e 189432 54 174224 0% /config
/dev/bo0s3f 5169908 420800 4335516 9% /cf/var
/dev/md2 1056324 112614 859206 12% /mfs
/cf/var/jail 5169908 420800 4335516 9% /jail/var
/cf/var/jails/rest-api 5169908 420800 4335516 9% /web-api/var
devfs 1 1 0 100% /jail/dev
/dev/md3 1884 4 1730 0% /jail/mfs
/dev/ssd 96138198 6 88447138 0% /var/ssd

I configured the following

set security log mode stream
set security log file name traffic-log
set security log file path /var/ssd/traffic-log/

set system syslog file traffic-log any any
set system syslog file traffic-log match RT_FLOW_SESSION

The policy sets log session-init /log session-close and flow session also exists.

However, the file is not created in the /var/ssd/traffic-log/ directory.

Please tell me how to save traffic flow using srx340 ssd on-box.

Please help Juniper experts...

------------------------------
minho kim
------------------------------

We will share the test results.

SRX branch equipment does not support saving to ON-BOX (SSD) in stream mode.

Junos OS 19.4 version supports on-box (ssd) storage in stream mode.

To save on SSD, up to 100MB is possible with the settings below.

traffic log in the binary format.(default path is /var/log/)
#set security log mode event
#set security log format binary
#set security log file name traffic-log
#set security log file size 10
#set security log file files 10
#set security log file path /var/ssd/traffic-log/
> show security log file /var/ssd/traffic-log/traffic-log

Thank you

I'll try it and let you know the results.

Thank you

Hello!

Please run file list /mfs/var/ detail to see if the device properly linked the traffic-log folder for /var/ssd/traffic-log.
Reference: https://www.juniper.net/documentation/us/en/hardware/srx340/topics/task/ssd-installation-srx340-srx345.html

Also, for on-box logging you should use security log mode event.
Reference: https://www.juniper.net/documentation/us/en/software/junos/network-mgmt/topics/topic-map/system-logging-for-a-security-device.html#id-configuring-on-box-binary-security-log-files

Hi everyone

￭ Chassis Model : SRX340
￭ OS Version : 21.4R3-S5.4

I want to use srx340 ssd on-box to store traffic flow.

The SSD is mounted successfully as shown below.

root@FW> show system storage detail 
Filesystem 1024-blocks Used Avail Capacity Mounted on
/dev/da0s2a 600594 430014 122534 78% /
devfs 1 1 0 100% /dev
/dev/md0 20012 12416 5996 67% /junos
/cf/packages 600594 430014 122534 78% /junos/cf/packages
devfs 1 1 0 100% /junos/cf/dev
/dev/md1 1458820 1458820 0 100% /junos
/cf 20012 12416 5996 67% /junos/cf
devfs 1 1 0 100% /junos/dev/
/cf/packages 600594 430014 122534 78% /junos/cf/packages1
procfs 4 4 0 100% /proc
/dev/bo0s3e 189432 54 174224 0% /config
/dev/bo0s3f 5169908 420800 4335516 9% /cf/var
/dev/md2 1056324 112614 859206 12% /mfs
/cf/var/jail 5169908 420800 4335516 9% /jail/var
/cf/var/jails/rest-api 5169908 420800 4335516 9% /web-api/var
devfs 1 1 0 100% /jail/dev
/dev/md3 1884 4 1730 0% /jail/mfs
/dev/ssd 96138198 6 88447138 0% /var/ssd

I configured the following

set security log mode stream
set security log file name traffic-log
set security log file path /var/ssd/traffic-log/

set system syslog file traffic-log any any
set system syslog file traffic-log match RT_FLOW_SESSION

The policy sets log session-init /log session-close and flow session also exists.

However, the file is not created in the /var/ssd/traffic-log/ directory.

Please tell me how to save traffic flow using srx340 ssd on-box.

Please help Juniper experts...

------------------------------
minho kim
------------------------------