Viewing Syslog Format Output; Exporting To A Script; Using Script Required And Optional Format-Specific Filters - Juniper NETWORK AND SECURITY MANAGER 2010.3 - ADMINISTRATION GUIDE REV1 Administration Manual

Syslog Multiple
--facility Yes
Script Multiple
--script-name No
Copyright © 2010, Juniper Networks, Inc.
Required
Yes
The syslog format has no optional format-specific filters.

Viewing Syslog Format Output

Syslog messages use the following format:
<day id>, <record id>, <timeReceived>, <timeGenerated>, <devicedomain>,
<devicedomainVersion>, <deviceName>, <deviceIpAddress>, <category>, <subcategory>,
<src zone>, <src intface>, <src addr>, <src port>, <nat src addr>, <nat src
port>, <dst zone>, <dst intface>, <dst addr>, <dst port>, <nat dst addr>, <nat
dst port>, <protocol>, <rule domain>, <rule domainVersion>, <policyname>,
<rulebase>, <rule number>, <action>, <severity>, <is alert>, <details>, <user
str>, <application str>, <uri str>, <elapsed>, <bytes in>, <bytes out>, <bytes
total>, <packet in>, < packet out>, < packet total>, <repeatCount>,
<hasPacketData>, <varData Enum>,<application name>,<device family>, <policy id>

Exporting to a Script

The script action directs the system to execute a script, use STDIN to pass log records
formatted as XML to the script, and report output status. You must specify the name of
the script that receives the exported log records (script must be located in the
/usr/netscreen/DevSvr/lib/scripts/ directory).
To export:
Login to the Device Server as root, then change to the utility directory by typing: cd
1.
/usr/netscreen/DevSvr/lib.
To export to a file, type:
2.
sh devSvrCli.sh --log2action --action --script <script-name>
<error-handling>
The Device Server exports all log records to the specified script.

Using Script Required and Optional Format-Specific Filters

You can use the following required format-specific filters for exporting to a script:
Required
Yes
Meaning
Specifies the facility that receives syslog messages. For
details on the facility parameter, refer to section 4.1.1 of
RFC 3164.
The syslog severity, also used to calculate the overall
syslog message priority, is automatically set to alert.
Meaning
Specify the script name. The script must be located in
/usr/netscreen/DevSvr/var/scripts/<domain>/<script-name>
For example:
/usr/netscreen/DevSvr/var/scripts/global/<script-name>
or
/ usr / netscreen/DevS vr / var / scri p ts/ gl o bal/<subdomai n >/<scri p t-name>
Chapter 19: Logging
797