Support Support Downloads Knowledge Base Case Manager My Juniper Community

Knowledge Base

Search our Knowledge Base sites to find answers to your questions.

Ask All Knowledge Base Sites All Knowledge Base Sites JunosE Defect (KA)Knowledge BaseSecurity AdvisoriesTechnical BulletinsTechnotes Sign in to display secure content and recently viewed articles

[MX] Understanding the effect of "eventd" on syslog activity

0

0

Article ID: KB33609 KB Last Updated: 08 Feb 2019Version: 1.0
Summary:

This article provides information about how the eventd process is related to syslog activity.

 

Symptoms:

Syslog activity is not happening even though eventd is configured.

 

Cause:

The eventd process is essential for any syslog activity to happen. If this process is not running due to a software defect, or is disabled via configuration such as the following, syslog activity will not happen:

system {
    processes {
        event-processing disable;
    }
}
 

Check whether the process is running by using the following command:

labroot@rtr> show system processes extensive | match eventd    <<< Shows that the process is not running

 

Solution:

To fix this problem and resume syslog activity, perform either of the following:

  1. If the process has been disabled through configuration as shown above, remove the specific configuration and check whether the process is running.
labroot@rtr> edit 
Entering configuration mode

[edit]
labroot@rtr# delete system processes event-processing disable 

[edit]
labroot@rtr# commit 
commit complete

labroot@rtr> show system processes extensive | match eventd 
52118 root      20    0   727M 13292K select  1   0:00   0.00% eventd <<< Shows that eventd is running 
 

OR

  1. If the process has not been disabled through configuration but is still not running due to a software defect, try to restart the process from the shell as a root user:

    1. Log in to the shell as a root user from the Command Line Interface (CLI).
labroot@rtr> start shell user root  
Password:
root@rtr:/var/home/labroot # 
  1. Execute the following command to start the eventd process.

root@rtr:/var/home/labroot # /usr/sbin/eventd -N -r -s -A & <
[1] 53141
  1. Check from the shell whether the eventd process is running:

root@rtr:/var/home/labroot # ps -aux | grep eventd <<< 
root    53141   0.0  0.0  744152  13260  0  S    15:15       0:00.05 /usr/sbin/eventd -N -r -s -A <<< Shows that the process is running
root    53147   0.0  0.0   16604   2260  0  S+   15:17       0:00.00 grep eventd
root@rtr:/var/home/labroot # exit

labroot@rtr> show system processes extensive | match eventd   <<< CLI shows eventd process is running now.
53141 root      20    0   727M 13260K select  1   0:00   0.00% eventd

 

Comment on this article > Affected Products Browse the Knowledge Base for more articles related to these product categories. Select a category to begin.

Getting Up and Running with Junos

Getting Up and Running with Junos Security Alerts and Vulnerabilities Product Alerts and Software Release Notices Problem Report (PR) Search Tool EOL Notices and Bulletins JTAC User Guide Customer Care User Guide Pathfinder SRX High Availability Configurator SRX VPN Configurator Training Courses and Videos End User Licence Agreement Global Search