Support Support Downloads Knowledge Base Case Manager My Juniper Community

Knowledge Base

Search our Knowledge Base sites to find answers to your questions.

Ask All Knowledge Base Sites All Knowledge Base Sites JunosE Defect (KA)Knowledge BaseSecurity AdvisoriesTechnical BulletinsTechnotes Sign in to display secure content and recently viewed articles

[SRX] How to add CustomLog with source IP address and time information after accessing your device via J-Web

0

0

Article ID: KB31059 KB Last Updated: 04 Mar 2017Version: 2.0
Summary:

This article explains how to add CustomLog which includes the source IP address and time information after accessing your SRX device via J-Web.

Symptoms:

How to add CustomLog which includes the source IP address and time information after accessing your SRX device via J-web.

Solution:

CAUTION: Perform the following edits with caution. Any mistakes may cause J-Web or any related HTTP server services to fail to start.

Enter into shell mode with root account:

> start shell user root
% cd /cf/var/jail/etc
% vi httpd.conf

Then add the changes and save them:


ErrorLog /var/log/httpd.log
LogLevel 2
CustomLog /var/log/access.log "%h %l %u %t \"%r\" %>s %b" <<<---here
DirectoryIndex index.php
...
:wq

root@SRX> show system processes extensive | match http
59242 nobody 2 88 0 9692K 4200K ucondt 0 0:02 0.00% httpd <<<----here
59077 root 1 76 0 13532K 6264K select 0 0:01 0.00% httpd-gk

%kill -9 59242

NOTE: Running the CLI command, ‘restart web-management’ will not work in this case because it restarts the httpd-gkprocess as well, which will cause the httpd.conf to be regenerated and void all previous changes. This change will not survive reboots.

Verification

Access your SRX via J-Web, then issue the command, ‘show log access.log’

10.141.25.29 - - [Wed Jun 22 08:54:23 2016 UTC] "POST /logout.php HTTP/1.1" 200 448
10.141.25.29 - - [Wed Jun 22 08:54:28 2016 UTC] "GET /index.php HTTP/1.1" 200 7274
10.141.25.29 - - [Wed Jun 22 08:54:49 2016 UTC] "POST /login.php HTTP/1.1" 200 7313
10.141.25.29 - - [Wed Jun 22 08:55:20 2016 UTC] "POST /login.php HTTP/1.1" 200 84145
10.141.25.29 - - [Wed Jun 22 08:55:21 2016 UTC] "POST /call.php HTTP/1.1" 200 446

Comment on this article > Affected Products Browse the Knowledge Base for more articles related to these product categories. Select a category to begin.

Getting Up and Running with Junos

Getting Up and Running with Junos Security Alerts and Vulnerabilities Product Alerts and Software Release Notices Problem Report (PR) Search Tool EOL Notices and Bulletins JTAC User Guide Customer Care User Guide Pathfinder SRX High Availability Configurator SRX VPN Configurator Training Courses and Videos End User Licence Agreement Global Search