Preserve Junos Syslog Severity When Forwarding Logs to a SIEM

The problem

Junos devices can forward standard-format syslog messages without placing the event priority in the visible message text. If an intermediate relay or downstream parser does not preserve the original syslog header, the SIEM may receive the event without dependable facility and severity information.

Junos treats facility and severity together as the message priority. For standard-format messages sent to a remote host, the explicit-priority statement places that information in the message itself.

Configure Junos

Add explicit-priority to the existing remote syslog destination. This changes the message format; it does not change which severity threshold is forwarded.

set system syslog host 192.0.2.50 any info
set system syslog host 192.0.2.50 explicit-priority
commit confirmed 5

Forwarding and severity are different: any info selects messages at the configured threshold. explicit-priority preserves each selected event's original facility and severity in the standard-format message.

What changes

Without explicit priority, a standard-format event can look like this:

Aug 21 12:36:30 switch01 chassisd[522]: CHASSISD_PARSE_COMPLETE: Using new configuration

With explicit priority, Junos prepends the facility and numerical severity to the tag:

Aug 21 12:36:30 switch01 chassisd[522]: %DAEMON-6-CHASSISD_PARSE_COMPLETE: Using new configuration

In this example, DAEMON is the facility, 6 is informational severity, and CHASSISD_PARSE_COMPLETE remains the message tag.

Verify at the first receiver

Capture the raw traffic on the first receiver before troubleshooting a relay or SIEM parser. Replace the example source address with the Junos device address.

# UDP syslog on port 514
sudo tcpdump -ni any -A 'udp port 514 and host 192.0.2.10'

# TCP syslog on port 514
sudo tcpdump -ni any -A 'tcp port 514 and host 192.0.2.10'

If the raw event contains %FACILITY-SEVERITY-, Junos is doing its part. If that information disappears later, examine the relay, transport framing, field extraction, and SIEM parser in that order.

Important format exception

Juniper documents that structured-data messages already include priority information. When structured-data is configured for a file destination, explicit-priority is ignored for that file. Confirm the format used by the actual remote destination before changing production devices.

Rollback

delete system syslog host 192.0.2.50 explicit-priority
commit

References

• Juniper Networks — explicit-priority CLI reference
• Juniper Networks — System Logging on a Single-Chassis System
• Juniper Networks — Direct System Log Messages to a Remote Destination