Juniper

LogZilla App Store application: Juniper

Overview

Juniper Networks develops and markets networking products, including routers, switches, network management software, network security products, and software-defined networking technology. JunOS is Juniper's network operating system that runs on their hardware platforms.

The Juniper app processes JunOS log messages from various Juniper Networks hardware units, extracting security and network flow information for analysis.

App Function

The Juniper app processes two types of JunOS log messages:

Structured Messages

  • Recognizes a wide range of JunOS message types (see supported log types below)
  • Sets appropriate user tags for fields contained in each message type
  • Supports extensible message recognition for new event types

Unstructured Messages

  • Focuses on session-related events (RT_FLOW_SESSION_CREATE, RT_FLOW_SESSION_CLOSE, RT_FLOW_SESSION_DENY)
  • Reformats log messages into key/value pairs
  • Creates user tags for easier analysis and filtering

Vendor Documentation

Log Source Details

ItemValue
VendorJuniper Networks
Device TypeRouters, switches, and security devices running JunOS
Supported Software Version(s)JunOS 11.x and newer (tested on SRX-series firewalls)
Collection MethodSyslog
Configurable Log Output?Partially – JunOS supports both structured and unstructured syslog formats
Log Source TypeJunOS syslog
ExceptionsN/A

Incoming Log Format

Juniper JunOS devices generate syslog messages in two distinct formats:

Structured Format: Uses structured data elements with key-value pairs enclosed in brackets, following RFC 5424 structured data format.

Unstructured Format: Uses space-separated fields in a fixed order, primarily for session flow events.

Both formats are processed by the Juniper app to extract relevant security and network flow information.

Supported Log Types

Supported Structured Message Types

Any event whose message type (MSGID) is listed in the RECOGNIZED_MESSAGE_IDS section of the config file. Supported message types include:

  • SECINTEL_SERVICE_MANAGEMENT
  • AAMWD_NETWORK_CONNECT_FAILED
  • APPTRACK_SESSION_CREATE
  • APPTRACK_SESSION_CLOSE
  • LIBJSNMP_NS_LOG_WARNING
  • RTLOG_CONN_ERROR
  • LICENSE_EXPIRED_KEY_DELETED
  • UI_NETCONF_CMD
  • UI_CHILD_START
  • UI_CHILD_STATUS
  • RT_FLOW_SESSION_CREATE
  • RT_FLOW_SESSION_CLOSE
  • RT_FLOW_SESSION_DENY

Supported Unstructured Message Types

Session-related events (RT_FLOW_SESSION_CREATE, RT_FLOW_SESSION_CLOSE, RT_FLOW_SESSION_DENY) output as space-separated fields (see log examples below).

Parsed Metadata Fields

The Juniper app extracts the following fields from both structured and unstructured messages and converts them into user tags:

TaggedField NameTag NameExampleDescription
☑MSGIDmsgidAAMWD_NETWORK_CONNECT_FAILEDJunOS message identifier (event type)
☑hostnamehostnamehost1.us-west-1.company.netHost that generated the log
☑category-namecategory-namesecurityJunOS category of the event
☑ip-addressSrcIP11.22.33.44Source IP address
☑source-portSrcPortdynamicSource port service
☑destination-portDstPorthttpsDestination port service
☑destination-addressDstIP55.66.77.88Destination IP address
☑ingress-interfaceingress-interfacereth8.1122Physical / logical ingress interface
☑service-nameservice-nameNoneJunOS service name associated with the flow
☑policy-namepolicy-namePolicyEnforcer-Rule1-1Security policy that matched the flow
☑reasonreasonICMP errorReason for session close / deny
☑applicationapplicationUNKNOWNDetected application name
☑nested-applicationnested-applicationUNKNOWNNested-application name (if any)
☑nat-source-addressnat-source-address11.22.33.44Post-NAT source IP
☑nat-destination-addressnat-destination-address55.66.77.88Post-NAT destination IP
☑nat-source-portnat-source-portdynamicPost-NAT source port service
☑nat-destination-portnat-destination-portdynamicPost-NAT destination service
☑usernameusernameN/AUsername associated with the event
☑src-nat-rule-namesrc-nat-rule-namesource-nat-ruleName of source-NAT rule
☑src-nat-rule-typesrc-nat-rule-typesource ruleType of source-NAT rule
☑dst-nat-rule-namedst-nat-rule-nameN/AName of destination-NAT rule
☑dst-nat-rule-typedst-nat-rule-typeN/AType of destination-NAT rule
☑protocol-idprotocol-id6IP protocol number (TCP=6, UDP=17, …)
☑proxy-addressproxy-address1.2.3.4Proxy server IP (if used)
☑proxy-portproxy-port8080Proxy server port
☑source-zone-namesource-zone-nametrustSource security zone
☑destination-zone-namedestination-zone-nameuntrustDestination security zone
☑rolesrolesadminUser roles involved in the event
☑encryptedencryptedUNKNOWNIndicates if the session is encrypted
☑packet-incoming-interfacepacket-incoming-interfacege-0/0/1.0Interface that received the first packet
☑stream-namestream-namespamName of log/event stream
☑filenamefilenameJUNOS966182Filename or key referenced in the log
☑error-messageerror-messageUnauthorizedError text returned by the system

Unstructured Message Key/Value Pairs

For unstructured messages, the app reformats the event message text into key/value pairs. The following fields are extracted:

Field KeyExample
reasonTCP SERVER RST
src11.22.33.44
dst55.66.77.88
src-port50488
dst-port48001
serviceNone
policy13101705
nat-src11.22.33.44
nat-src-port50488
nat-dst55.66.77.88
nat-dst-port48001
src-nat-ruleN/A
dst-nat-ruleN/A
protocol6
src-zoneDMZ_One
dst-zoneDMZ_Two
session-id120095417
ingress-interfacereth8.1122

High-Cardinality (HC) Tags

  • SrcIP
  • DstIP

Log Examples

Structured Message - Session Close

text
2018-07-13T09:49:21.734Z TESTER RT_FLOW - RT_FLOW_SESSION_CLOSE
[[email protected] reason="ICMP error" source-address="11.22.33.44"
source-port="1298" destination-address="55.66.77.88"
destination-port="53" service-name="None"
nat-source-address="11.22.33.44" nat-source-port="8325"
nat-destination-address="55.66.77.88" nat-destination-port="53"
src-nat-rule-type="source rule" src-nat-rule-name="source-nat-rule"
dst-nat-rule-type="N/A" dst-nat-rule-name="N/A" protocol-id="6"
policy-name="PolicyEnforcer-Rule1-1" source-zone-name="trust"
destination-zone-name="untrust" session-id-32="20267666"
packets-from-client="1" bytes-from-client="64" packets-from-server="0"
bytes-from-server="0" elapsed-time="1" application="INCONCLUSIVE"
nested-application="INCONCLUSIVE" username="N/A" roles="N/A"
packet-incoming-interface="ge-0/0/1.0" encrypted="UNKNOWN"]

Structured Message - Network Connect Failed

text
2024-06-01T12:34:56.789Z TESTER AAMWD - AAMWD_NETWORK_CONNECT_FAILED
[[email protected] severity="2" proxy-port="None" proxy-address="None"
ip-address="11.22.33.44" hostname="host1.us-west-1.company.net"
error-message="Unauthorized" destination-port="443"] <2> Access host
srxapi.eu-west-1.sky.junipersecurity.net on ip 52.210.70.159 port 443 proxy
None port None Unauthorized.

Unstructured Message - Session Close

text
RT_FLOW_SESSION_CLOSE: session closed TCP SERVER
RST: 11.22.33.44/50488->55.66.77.88/48001 None
11.22.33.44/50488->55.66.77.88/48001 N/A N/A N/A N/A 6
13101705 DMZ_One DMZ_Two 120095417 16(8769) 15(1262) 2
UNKNOWN UNKNOWN N/A(N/A) reth8.1122 UNKNOWN

Unstructured Message - Session Denied

text
RT_FLOW_SESSION_DENY: session denied
11.22.33.44/36619->55.66.77.88/23 junos-telnet 6(0)
default-deny-log untrust DMZ_TESTONE UNKNOWN UNKNOWN N/A(N/A)
reth8.88 UNKNOWN policy deny
Juniper | LogZilla Documentation