Juniper

LogZilla App Store application: Juniper

JunOS

Juniper Networks develops and markets networking products, including routers, switches, network management software, network security products, and software-defined networking technology.

This app is focused on Juniper JunOS messages produced by various Juniper Networks hardware units.

App Function

This app handles two different types of JunOS log messages: structured and unstructured. These two message types are explained below.

For structured messages, the app recognizes a wide range of JunOS message types, not just RT_FLOW (see below under Currently Supported LogTypes). For each recognized type, the app sets appropriate user tags for fields contained in that type of log message. More messages will be added over time, and the user has the option of updating the messages and associated user tags themselves, if needed (contact LogZilla support for assistance).

For unstructured messages, the app focuses on session-related events (such as RT_FLOW_SESSION_CREATE, RT_FLOW_SESSION_CLOSE, RT_FLOW_SESSION_DENY), reformats the log message into key/value pairs, and sets user tags for easier comprehension.

Vendor Documentation

Log Source Details

ItemValue
VendorJuniper Networks
Device TypeRouters, switches, and security devices running JunOS
Supported Software Version(s)JunOS 11.x and newer (tested on SRX-series firewalls)
Collection MethodSyslog
Configurable Log Output?Partially – JunOS supports both structured and unstructured syslog formats
Log Source TypeJunOS syslog
ExceptionsN/A

Currently Supported Log Types

  • Structured messages: Any event whose message type (MSGID) is listed in the RECOGNIZED_MESSAGE_IDS section of the config file. This includes, but is not limited to:
    • SECINTEL_SERVICE_MANAGEMENT
    • AAMWD_NETWORK_CONNECT_FAILED
    • APPTRACK_SESSION_CREATE
    • APPTRACK_SESSION_CLOSE
    • LIBJSNMP_NS_LOG_WARNING
    • RTLOG_CONN_ERROR
    • LICENSE_EXPIRED_KEY_DELETED
    • UI_NETCONF_CMD
    • UI_CHILD_START
    • UI_CHILD_STATUS
    • RT_FLOW_SESSION_CREATE
    • RT_FLOW_SESSION_CLOSE
    • RT_FLOW_SESSION_DENY
  • Unstructured messages: Session-related events such as RT_FLOW_SESSION_CREATE, RT_FLOW_SESSION_CLOSE, and RT_FLOW_SESSION_DENY output as space-separated fields (see log samples below).

Parsed Metadata Fields

For both structured and unstructured messages the following fields are parsed and (where a Tag Name is given) converted into user tags:

TaggedField NameTag NameExampleDescription
☑MSGIDmsgidAAMWD_NETWORK_CONNECT_FAILEDJunOS message identifier (event type)
☑hostnamehostnamehost1.us-west-1.company.netHost that generated the log
☑category-namecategory-namesecurityJunOS category of the event
☑ip-addressSrcIP11.22.33.44Source IP address
☑source-portSrcPortdynamicSource port service
☑destination-portDstPorthttpsDestination port service
☑destination-addressDstIP55.66.77.88Destination IP address
☑ingress-interfaceingress-interfacereth8.1122Physical / logical ingress interface
☑service-nameservice-nameNoneJunOS service name associated with the flow
☑policy-namepolicy-namePolicyEnforcer-Rule1-1Security policy that matched the flow
☑reasonreasonICMP errorReason for session close / deny
☑applicationapplicationUNKNOWNDetected application name
☑nested-applicationnested-applicationUNKNOWNNested-application name (if any)
☑nat-source-addressnat-source-address11.22.33.44Post-NAT source IP
☑nat-destination-addressnat-destination-address55.66.77.88Post-NAT destination IP
☑nat-source-portnat-source-portdynamicPost-NAT source port service
☑nat-destination-portnat-destination-portdynamicPost-NAT destination service
☑usernameusernameN/AUsername associated with the event
☑src-nat-rule-namesrc-nat-rule-namesource-nat-ruleName of source-NAT rule
☑src-nat-rule-typesrc-nat-rule-typesource ruleType of source-NAT rule
☑dst-nat-rule-namedst-nat-rule-nameN/AName of destination-NAT rule
☑dst-nat-rule-typedst-nat-rule-typeN/AType of destination-NAT rule
☑protocol-idprotocol-id6IP protocol number (TCP=6, UDP=17, …)
☑proxy-addressproxy-address1.2.3.4Proxy server IP (if used)
☑proxy-portproxy-port8080Proxy server port
☑source-zone-namesource-zone-nametrustSource security zone
☑destination-zone-namedestination-zone-nameuntrustDestination security zone
☑rolesrolesadminUser roles involved in the event
☑encryptedencryptedUNKNOWNIndicates if the session is encrypted
☑packet-incoming-interfacepacket-incoming-interfacege-0/0/1.0Interface that received the first packet
☑stream-namestream-namespamName of log/event stream
☑filenamefilenameJUNOS966182Filename or key referenced in the log
☑error-messageerror-messageUnauthorizedError text returned by the system

For unstructured messages the event message text is additionally reformatted to consist of key/value pairs. The specific fields that are emitted as keys are as follows:

Field KeyExample
reasonTCP SERVER RST
src11.22.33.44
dst55.66.77.88
src-port50488
dst-port48001
serviceNone
policy13101705
nat-src11.22.33.44
nat-src-port50488
nat-dst55.66.77.88
nat-dst-port48001
src-nat-ruleN/A
dst-nat-ruleN/A
protocol6
src-zoneDMZ_One
dst-zoneDMZ_Two
session-id120095417
ingress-interfacereth8.1122

High-Cardinality (HC) Tags

SrcIP, DstIP

Log Samples

Structured Message - Session Close

2018-07-13T09:49:21.734Z TESTER RT_FLOW - RT_FLOW_SESSION_CLOSE
[[email protected] reason="ICMP error" source-address="11.22.33.44"
source-port="1298" destination-address="55.66.77.88"
destination-port="53" service-name="None"
nat-source-address="11.22.33.44" nat-source-port="8325"
nat-destination-address="55.66.77.88" nat-destination-port="53"
src-nat-rule-type="source rule" src-nat-rule-name="source-nat-rule"
dst-nat-rule-type="N/A" dst-nat-rule-name="N/A" protocol-id="6"
policy-name="PolicyEnforcer-Rule1-1" source-zone-name="trust"
destination-zone-name="untrust" session-id-32="20267666"
packets-from-client="1" bytes-from-client="64" packets-from-server="0"
bytes-from-server="0" elapsed-time="1" application="INCONCLUSIVE"
nested-application="INCONCLUSIVE" username="N/A" roles="N/A"
packet-incoming-interface="ge-0/0/1.0" encrypted="UNKNOWN"]

Structured Message - Network Connect Failed

2024-06-01T12:34:56.789Z TESTER AAMWD - AAMWD_NETWORK_CONNECT_FAILED
[[email protected] severity="2" proxy-port="None" proxy-address="None"
ip-address="11.22.33.44" hostname="host1.us-west-1.company.net"
error-message="Unauthorized" destination-port="443"] <2> Access host
srxapi.eu-west-1.sky.junipersecurity.net on ip 52.210.70.159 port 443 proxy
None port None Unauthorized.

Unstructured Message - Session Close

RT_FLOW_SESSION_CLOSE: session closed TCP SERVER
RST: 11.22.33.44/50488->55.66.77.88/48001 None
11.22.33.44/50488->55.66.77.88/48001 N/A N/A N/A N/A 6
13101705 DMZ_One DMZ_Two 120095417 16(8769) 15(1262) 2
UNKNOWN UNKNOWN N/A(N/A) reth8.1122 UNKNOWN

Unstructured Message - Session Denied

RT_FLOW_SESSION_DENY: session denied
11.22.33.44/36619->55.66.77.88/23 junos-telnet 6(0)
default-deny-log untrust DMZ_TESTONE UNKNOWN UNKNOWN N/A(N/A)
reth8.88 UNKNOWN policy deny
Juniper | LogZilla Documentation