Problem with Juniper Syslog

[I.Mitidieri]

Hi, this is my first post and I need help.

I am trying to connect the syslog of a Juniper ACX7024X to my Broker, but I cannot see any logs.

The router is sending logs, but I cannot see anything from Cortex. I set it to raw format, auto-select, but nothing.

I understand that everything is configured correctly on the router, although we tried different formats and even with UDP we couldn't get it to create a dataset.

PS: I had no problems with Forti.

Thanks.

Cortex XDR 

[susekar]

Hello @I.Mitidieri ,

Greetings for the day.

This issue is often related to service instability on the Broker VM, configuration mismatches, or logs being routed to a generic dataset.

1. Verify Ingestion via XQL Search:

If the Syslog Collector is set to "RAW" or "Auto-Detect" and the log format is not natively recognized (such as CEF or LEEF), the logs will not create a specific Juniper dataset. Instead, they are placed in the generic unknown_unknown_raw dataset.

Use the following XQL query to confirm whether the logs are reaching the tenant:

dataset = unknown_unknown_raw
| filter _reporter_ip = "<BROKER_VM_IP>"

2. Verify Connectivity on the Broker VM:

Ensure the Broker VM is actively listening and receiving traffic from the Juniper router. You can run the following commands from the Broker VM CLI:

Check Listening Port

netstat -an | grep 514

Capture Incoming Traffic:

Replace <INTERFACE> with your management interface (e.g., ens160 or eth0) and <ROUTER_IP> with the Juniper router's IP:

sudo tcpdump -i <INTERFACE> -s0 -A udp port 514 and src <ROUTER_IP>

3. Check and Restart Syslog Services:

A known issue with Juniper log ingestion involves the anubis container (the service responsible for syslog processing) crashing or becoming unstable.

If traffic reaches the VM but is not visible in XQL, restart the relevant services via the Broker VM Live Terminal:

sbin/applets_stop anubis
sbin/services_restart rabbitmq-server
sbin/applets_start anubis

4. Explicitly Configure Vendor and Product:

Using "Auto-Detect" for the Vendor and Product fields may fail for network devices if the log headers do not perfectly match a predefined template.

To force the creation of a dedicated dataset, modify the Syslog Collector applet configuration:

1. Navigate to Settings > Configurations > Data Broker > Broker VMs.

2. Select your Broker VM and open the Syslog Collector applet settings.

3. Change Vendor from "Auto-Detect" to Juniper (case-sensitive).

4. Change Product to a descriptive name (e.g., ACX_Router).

5. Set Format to RAW.

5. Check for Kernel Dropped Packets (RPF)

If tcpdump shows traffic arriving but the Broker VM counters show 0 logs, the Linux kernel may be dropping packets due to a Reverse Path Filter (RPF) mismatch (asymmetric routing).

This occurs if logs arrive on one interface, but the routing table indicates that the return path would use a different interface.

If you feel this has answered your query, please let us know by clicking like and on "mark this as a Solution".

Thanks & Regards,
S. Subashkar Sekar