SRX

Hi All,

      Having a bit of a weird issue with my SRX210.  It seems as all traffic logging has recently stopped.  I have an SRX 100 with the exact same syslog configuration and it is logging traffic fine.

I have included the pertinant configs.  * Note I tried withought the file Accepted traffic & blocked traffic, still would not work

user * {
    any emergency;
}
file messages {
    any any;
    authorization info;
}
file interactive-commands {
    interactive-commands any;
}
file accepted-traffic {
    any any;
    match RT_FLOW_SESSION_CREATE;
}
file blocked-traffic {
    any any;
    match RT_FLOW_SESSION_DENY;
}

***********

policy trust-to-untrust {
    match {
        source-address any;
        destination-address any;
        application any;
    }
    then {
        permit {
            application-services {
                utm-policy custom-utm-policy;
            }
        }
        log {
            session-init;
        }
    }
}

Any have a clue?

Thanks,

Hi,

Try a "commit full" and if that doesn't work check the available disk space on our box.  I've come across an issue where one of these two stopped logging.

-John

Thanks for the suggestions but both of those dont fix my issue.

I have 24% of storage used and the commit full did not seem to fix it.  Any other idea's?  Can I manually restart the logging deamon.  The system seems to log because I can see my web filter request logs, i just dont see any traffic logs.

do you need a "session-close" on the policy logging for this.

I dont need one but I did try adding it to see if it worked....it did not.

Did you try adding a deny all rule (with a log statement) to see if that logs properly?

No, Its in production so I cant really do that.  I will update to 10.1 later to see if that fixes it.  This is definatly a glitch because I took  the config and pasted it onto another SRX 210 and the logging works fine.

Thanks for all the suggestions though.

Hi,

Just try this "set security log mode event" to force writing logs to file.

Albert

Thanks Albert that fixed the problem right away!