Re: How to find newly created session from logs?

Hi,

The session creating information could be found in the traffic logs of the SRX with the keyword "RT_FLOW".

These can/cannot be seen on the SRX depending on the type of logging you are using.

The logging has to be enabled on the security policy which the sessions are hitting in order to see these in the log messages.

To check the connection creation rate, please use the following command :-

root> show security monitoring fpc 0                 
FPC 0
  PIC 0
    CPU utilization          :    0 %
    Memory utilization       :   72 %
    Current flow session     :    3
    Current flow session IPv4:    3
    Current flow session IPv6:    0
    Max flow session         : 1048576
    Current CP session       :    3
    Current CP session   IPv4:    3
    Current CP session   IPv6:    0
    Max CP session           : 1048576Total Session Creation Per Second (for last 96 seconds on average):    0
IPv4  Session Creation Per Second (for last 96 seconds on average):    0
IPv6  Session Creation Per Second (for last 96 seconds on average):    0

For interpreting the flow session output, pelase go through the following link :-

https://kb.juniper.net/InfoCenter/index?page=content&id=KB21719&smlogin=true&actp=search

Regards,

Sahil Sharma

---------------------------------------------------

Please mark my solution as accepted if it helped, Kudos are appreciated as well.