Juniper#

Integration Details
Ingester	Simple Relay
Kit	Juniper Kit

Juniper Configuration#

Resources

To configure the device, follow these steps adapted from Configure Syslog over TLS:

Specify the syslog server that receives the system log messages. You can specify the IP address of the syslog server or a fully qualified hostname. In this example, use 10.102.70.233 as the IP address of the syslog server.
```
user@host# set system syslog host 10.102.70.233 any any
```

Specify the port number of the syslog server.

user@host# set system syslog host 10.102.70.233 port 15051

Specify the syslog transport protocol for the device. In this example, use TLS as the transport protocol.
```
user@host# set system syslog host 10.102.70.233 transport tls
```
Specify the name of the trusted certificate authority (CA) group or specify the name of the CA profile to be used. In this example, use example-ca as the CA profile.
```
user@host# set system syslog host 10.102.70.233 tlsdetails trusted-ca-group trusted-ca-group-name ca-profiles example-ca
```

Log all messages to the local messages file.

user@host# set system syslog file messages any any

Commit the configuration.
```
user@host# commit
```
Verify the configuration.
```
user@host# show system syslog
```

Gravwell Configuration#

Gravwell Storage Well Configuration#

Setup the well configuration in your Gravwell indexers.

Sample well config:
Create or edit: /opt/gravwell/etc/gravwell.conf.d/juniper-well.conf

[Storage-Well "juniper"]
    Location=/opt/gravwell/storage/juniper
    Tags=juniper*

Gravwell Ingester Configuration: Simple Relay#

Sample Juniper config:
Create or edit: /opt/gravwell/etc/simple_relay.conf.d/juniper.conf

[Listener "junipertcp"]
    Bind-String="tls://0.0.0.0:15051"
    Cert-File=/opt/gravwell/etc/cert.pem
    Key-File=/opt/gravwell/etc/key.pem
    Reader-Type=rfc5424
    Tag-Name=juniper
    Assume-Local-Timezone=true #if a time format does not have a timezone, assume local time
    Keep-Priority=true # leave the <nnn> priority tag at the start of each syslog entry

Note

Remember to restart the service to apply the new config: sudo systemctl restart gravwell_simple_relay.service