Support Support Downloads Knowledge Base Juniper Support Portal Community

Knowledge Base

Search our Knowledge Base sites to find answers to your questions.

Ask All Knowledge Base Sites All Knowledge Base Sites JunosE Defect (KA)Knowledge BaseSecurity AdvisoriesTechnical BulletinsTechnotes Sign in to display secure content and recently viewed articles

[EX/QFX] How to collect logs and files from standalone and Virtual Chassis/VCF devices

0

0

Article ID: KB20569 KB Last Updated: 06 Oct 2021Version: 5.0
Summary:
 

This article details how to gather logs or files from most EX/QFX Series devices, which may play a vital role in Root Cause Analysis (RCA).

 

Solution:
 

Note that collection of logs differs across EX/QFX platforms. Follow the steps for your particular device:

 
 

Collecting Logs from a Standalone Switch

Option 1

  1. Enter the following command to archive the /var/log directory. The following command will zip (tar) the folder /var/log and name the file (LOGS.tar). It will also push the zipped file to the destination folder /var/tmp.

root@lab> file archive source /var/log destination /var/tmp/LOGS
root@lab> file list /var/tmp 
/var/tmp:
.snap/
LOCK_FILE*
LOGS.tar ​ <--File Created
  1. Perform the steps in the section Exporting/Extracting the Archived Logs Saved in /var/tmp in order to copy the archived logs to your PC or another source.

Option 2

  1. If there are any permission issues, perform the following steps in shell mode to collect the files by using the tar command with root credentials:

user@lab> start shell user root
root@lab% tar -zcvf /var/tmp/varlog.tar.gz /var/log/*

root@lab% ls /var/tmp | grep varlog
varlog.tar.gz ​ <--File Created
  1. Perform the steps in the section Exporting/Extracting the Archived Logs Saved in /var/tmp in order to copy the archived logs to your PC or another source.

 
 

Collecting Logs from Virtual Chassis/ Virtual Chassis Fabric

Option 1

Note: Collection of logs should be initiated from the primary device.

  1. Log in to the primary device. Here we assume that FPC0 is the primary device.

  2. Enter the following command to archive the /var/log directory of the primary device. The following command will zip (tar) the folder /var/log and name the file (MASTER-LOG.tar). It will also push the zipped file to the primary switch.

{master:0}
root@lab> file archive source /var/log destination fpc0:/var/tmp/MASTER-LOG
  1. Log in to the other VC members (backup RE or linecards). The steps will push a zipped file from the specified member ID to the primary switch (FPC0). The destination folder remains /var/tmp

{master:0}
root@lab> request session member 1  (For FPC1 it will be 1, and so on)
root@lab:LC:1% cli
{backup:1}
root@lab> file archive source /var/log destination fpc0:/var/tmp/BACKUP-LOG (This example copies files from FPC1 to primary FPC0; modify as needed)

root@lab> exit       <--Log out from CLI mode of FPC1.
root@lab:LC:1% exit  <--Log out from shell mode to return to the primary session.     

Note: JTAC typically requires the logs from the primary RE and the backup RE. If needed, repeat these steps for linecards as well by using the corresponding member ID.

  1. Log back in to the primary device. Check whether all required files are stored under the /var/tmp directory:

root@lab> file list /var/tmp | match log                
BACKUP-LOG.tar                   
MASTER-LOG.tar                
  1. Perform the steps in the section Exporting/Extracting the Archived Logs Saved in /var/tmp in order to copy the archived logs to your PC or another source.

Option 2

If there are any permission issues, perform the following steps to collect the files in shell mode, starting with the primary RE, by using the tar command with root credentials.

  1. Log in to the primary device. Here we assume that FPC0 is the primary device.

user@lab> start shell user root

root@lab% tar -zcvf /var/tmp/varlog-mem0.tar.gz /var/log/*
  1. Log in to the other VC members (backup RE or linecards). The steps will create a zipped file locally on this member ID with the destination folder /var/tmp

root@lab> request session member 1 (For FPC1 it will be 1, and so on)

root@lab:LC:1% tar -zcvf /var/tmp/varlog-mem1.tar.gz /var/log/*
  1. Go to the Command Line Interface (CLI) to copy the files from this particular VC member to the primary RE:

root@lab:LC:1% cli
{backup:1}
root@lab> file copy fpc1:/var/tmp/varlog-mem1.tar.gz fpc0:/var/tmp/

root@lab> exit       <--Log out from CLI mode of FPC1.
root@lab:LC:1% exit  <--Log out from shell mode to return to the primary session.

Note: JTAC typically requires the logs from the primary RE and the backup RE. If needed, repeat steps 3 and 4 for linecards as well by using the corresponding member ID.

  1. Log back in to the primary RE. Check whether all required files are stored in the /var/tmp directory:

root@lab> file list /var/tmp | match log                

varlog-mem0.tar.gz
varlog-mem1.tar.gz
  1. Perform the steps in the section Exporting/Extracting the Archived Logs Saved in /var/tmp in order to copy the archived logs to your PC or another source.

 
 

 Collecting Host Logs QFXs / EX4600

Sometimes JTAC requires to check host log files on certain platforms. If requested, perform the following steps:

  1. Go to host shell mode and use the tar command to compress the log files:

root@qfx5100> request app-engine host-shell <-- This command is hidden in some platforms; manually enter it on the CLI. 
root@qfx5100:~# tar -cvf /var/log/fpc0_host-logs.tar /var/log
  1. Verify that the file was created by using ls -al /var/log:

root@qfx5100:~# ls -al /var/log | grep host
-rw-r--r--  1 root root 13547520 Aug 14 13:43 fpc0_host-logs.tar <-- File Created

root@qfx5100:~# exit <-- Exit Host mode.
  1. Copy the file from the host to the Junos VM:

root@qfx5100> request app-engine file-copy from-jhost fpc0_host-logs.tar to-vjunos /var/tmp log

root@qfx5100> file list /var/tmp/| match host  
fpc0_host-logs.tar <-- File Copied

Note: If JTAC instructs to collect host log files for the backup REs or the linecards on the Virtual Chassis or VCF designs, continue with these steps, otherwise, go to the Exporting/Extracting the Archived Logs Saved in /var/tmp section.

  1. Go to host shell mode on a particular VC/VCF member:

root@qfx5100> request session member 1 (For FPC1 it will be 1, and so on)
root@qfx5100:BK:1% cli
{backup:1}
root@qfx5100> request app-engine host-shell 
  1. Using the tar command, compress the host logs files:

root@qfx5100:~# tar -czvf /var/tmp/fpc1.host.tgz /var/log <--Using FPC1 as example
root@qfx5100:~# ls -al /var/log | grep host
-rw-r--r--  1 root root 14305280 Aug 14 13:34 fpc1_host-logs.tar <-- File Created
root@qfx5100:~# exit <--Exit host shell mode.
  1. Copy the files from the host shell to var/tmp on this particular member:

{backup:1}
root@qfx5100> request app-engine file-copy from-jhost fpc1_host-logs.tar to-vjunos /var/tmp log
root@qfx5100> file list /var/tmp/ | match host
fpc1_host-logs.tar <-- File Copied
  1. Copy the file from this particular member to the primary RE; in this case FPC0 is our primary RE:

root@qfx5100> file copy fpc1:/var/tmp/fpc1_host-logs.tar fpc0:/var/tmp
root@qfx5100> exit <--Log out from CLI mode of FPC1.
root@qfx5100:LC:1% exit  <--Log out from shell mode to return to the primary session.

root@qfx5100> file list /var/tmp/ | match host 
fpc0_host-logs.tar
fpc1_host-logs.tar <--File copied to the primary

Note: Repeat steps 4 to 7 for each required member.

  1. Perform the steps in the section Exporting/Extracting the Archived Logs Saved in /var/tmp in order to copy the archived logs to your PC or another source.

 
 

Collecting Logs from 8200 Series - Multiple Routing Engines

Note: Collection of logs should be Initiated from the primary device.

  1. Log in to the primary Routing Engine. Here we assume that RE0 will be the primary device.

root@lab> request routing-engine login master
  1. Enter the following command to archive the /var/log directory of RE0. The following command will zip (tar) the folder /var/log and name the file (RE0-LOG.tar). It will also push the zipped file to the primary Routing Engine. The destination folder remains /var/tmp.

{master:0}
root@lab> file archive source /var/log destination re0:/var/tmp/RE0-LOG
  1. Log in to the backup Routing Engine. Here we assume that RE1 will be the backup device.

{master:0}
root@lab> request routing-engine login backup
root@lab% cli
{backup:1}
  1. Enter the following command to archive the /var/log directory of RE1. The following command will zip (tar) the folder /var/log and name the file (RE1-LOG.tar). It will also push the zipped file to the primary Routing Engine. The destination folder remains /var/tmp.

{backup:1}
root@lab> file archive source /var/log destination re1:/var/tmp/RE1-LOG
  1. Perform the steps in the section Exporting/Extracting the Archived Logs Saved in /var/tmp in order to copy the archived logs to your PC or another source.

IMPORTANT: The archive includes several files. Therefore, specify the actual date/time of the outage to be analyzed when giving the archived logs to your technical support representative. This will help speed up the analysis.

 
 

Exporting/Extracting the Archived Logs Saved in /var/tmp

Archived logs can be copied (exported) to your PC or another source by using either of the following methods:

Option 1: FTP

Download the saved logs on the device that is running Junos OS or switch through FTP services by performing the following:

  1. Prerequisite: FTP services must be enabled on the device or switch. These services are not enabled by default.

root@ex# set system service ftp
root@ex# commit 
  1. From the FTP client, log in to the switch (user: root).

  2. Change directory from /root to /var/tmp.

  3. Select the saved file. (Note: As per the above example, the filename could be either LOGS or MASTER-LOG.)

  4. Copy the saved file to the desired location by clicking Transfer.

Option 2: SCP

  1. Prerequisite: SSH needs to be allowed by using set system services ssh.

  2. Transfer the file by using SCP in shell mode with scp /path/to/file username@a:/path/to/destination.

Example

root@lab> start shell user root 
^Croot@lab:0% scp /var/tmp/fpc0_host-logs.tar root@10.185.241.37:/var/tmp

The authenticity of host '10.185.241.37 (10.185.241.37)' can't be established.
ECDSA key fingerprint is SHA256:KrSwrb/wxY8K8Y6iAmdl37n+klcbbv6aadagagagacdI.
Are you sure you want to continue connecting (yes/no)? yes

Warning: Permanently added '10.185.241.37' (ECDSA) to the list of known hosts.
Password:
fpc0_host-logs.tar                            100%   13MB  29.6MB/s   00:00    
root@lab:RE:0% 
  1. Additionally, you may SCP into the switch with port 22 by using an SCP client such as FileZile or WinSCP.

Option 3: J-Web

  1. Click Maintain > Files.

  2. Click Temporary Files in the /var/tmp directory.

  1. Select the check box next to the archived file collected above, and then click the Download action.

 

Modification History:
 

2021-04-08: Updated the article terminology to align with Juniper's Inclusion & Diversity initiative

2021-10-06: Updated article and incorporated related information from various articles into this one

 

Comment on this article > Affected Products Browse the Knowledge Base for more articles related to these product categories. Select a category to begin.

Getting Up and Running with Junos

Getting Up and Running with Junos Security Alerts and Vulnerabilities Product Alerts and Software Release Notices Problem Report (PR) Search Tool EOL Notices and Bulletins JTAC User Guide Customer Care User Guide Pathfinder SRX High Availability Configurator SRX VPN Configurator Training Courses and Videos End User Licence Agreement Global Search