Junos: Send Security Log Messages to a Remote Syslog Server

The following example specifies that security log messages in structured-data format are sent from 10.30.30.1 to a file named trafficlogs at 192.30.80.76 (remote syslog server).

1. Specify that the IP address of the source system is 10.30.30.1 (for example, the SRX Series device's loopback or other interface IP address).

user@host# set security log source-address 10.30.30.1

2. Specify that the messages are streamed to a file named trafficlogs on a remote log server with an IP address of 192.30.80.76.

user@host# set security log stream trafficlogs host 192.30.80.76

3. Starting in Junos 10.0, you can specify that security logs are sent from the data plane to the control plane, which is referred to as 'event' mode.  The default is 'stream' mode, which sends the traffic out the interface ports. You can also specify the rate at which logs are forwarded from the data plane to the control plane. 
   
   Specify that the security logs are sent at a rate of 500 messages per second:
   
   user@host# set security log event-rate 500

To specify that security logs are handled through the eventd process, use the following command:

user@host# set security log mode event