Support Support Downloads Knowledge Base Case Manager My Juniper Community

Knowledge Base

Search our Knowledge Base sites to find answers to your questions.

Ask All Knowledge Base Sites All Knowledge Base Sites JunosE Defect (KA)Knowledge BaseSecurity AdvisoriesTechnical BulletinsTechnotes Sign in to display secure content and recently viewed articles

[Junos] What happens to the logs on a device after a RE reboot or replacement?



Article ID: KB36378 KB Last Updated: 25 Dec 2020Version: 1.0
This article explains what happens to the logs on a Juniper device after it's RE (routing engine) is rebooted or replaced.
What happens to the syslogs on a Juniper device after it undergoes a reboot after the RE's are replaced?

It is important to understand that logs are stored under the /var directory. Different files are stored there, including messages, syslogs, chassisids, etc. Each of these capture a separate set of information from the specific daemon's perspective.

The /var directory is saved either on the hard drive or the flash drive of the respective REs. In case a Juniper device has 2 REs, each RE0 and RE1 will have their own sets of /var/log.

The hard drive or the flash drive are both persistent memory.  The contents of the /var directory is able to survive a reboot, which is why these come in handy to investigate the reasons behind the unexpected reboots of the REs. However, there can be instances when the logs for a specific file get rolled over due to a lower file size or specific logs being printed multiple times. It is a best practice to configure a higher value for the file size, add more number of files in case the content rolls over from the current file or mitigate or mask the chirping log messages.  

As each RE has their own sets of memory locations, hence the /var, it is necessary to check the specific logs when troubleshooting a specific RE issue. For example, RE0 var/log when checking for issues with RE0.

What happens to these log files when the REs are replaced? As these reside on memory locations of the RE itself, the var/log on the new RE will be different, which is why it is recommended to gather the var/log from both the REs if they are to be replaced as part of the troubleshooting effort. The logs from the previous RE can shed some light on their failure reason.

Comment on this article > Affected Products Browse the Knowledge Base for more articles related to these product categories. Select a category to begin.

Getting Up and Running with Junos

Getting Up and Running with Junos Security Alerts and Vulnerabilities Product Alerts and Software Release Notices Problem Report (PR) Search Tool EOL Notices and Bulletins JTAC User Guide Customer Care User Guide Pathfinder SRX High Availability Configurator SRX VPN Configurator Training Courses and Videos End User Licence Agreement Global Search