Hi Abhishek,
< set system syslog configuration> is for Control Plane Logging.
All processes that are running on the device (like JSRPD , Chassisd, kmd) generate logs are called control plane logs.
++++++++++++++++++++++++++++++++++++++++++++++++++++++++
< Set security log> : dataplane or PFE logs:
+++++++++++++++++
There are 2 modes of dataplane logs
1.Stream Mode
2. Event Mode
1.Stream Mode
++++++++++++
Session information generated through security policy are called traffic logs or dataplane logs.
It will be sent to the configured syslog server under security log hierarcy.
It will not goto Routing engine (system syslog)
2. Event Mode:
++++++++++++++++
Session information generated through security policy are called traffic logs or dataplane logs.
Event mode will push the PFE logs to the routing engine and you can see it the show system syslog server.
Event mode is known to cause High CPU on the RE . Stream mode is recommended.
Branch Devices by default has Event Mode security log settings.
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Following KB articles will help configuring Logging correctly:
http://kb.juniper.net/InfoCenter/index?page=content&id=KB16502
http://kb.juniper.net/InfoCenter/index?page=content&id=KB16509
http://kb.juniper.net/InfoCenter/index?page=content&id=KB16506
http://kb.juniper.net/InfoCenter/index?page=content&id=KB19490
http://kb.juniper.net/InfoCenter/index?page=content&id=KB16224
Regards
rparthi
Please Mark My Solution Accepted if it Helped, Kudos are Appreciated Too