> For the complete documentation index, see [llms.txt](https://jncia-workbook.gitbook.io/workbook/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://jncia-workbook.gitbook.io/workbook/junos-basics/23-local-logging.md).
# 23) Local Logging
### Pre-Work
If you made any changes, you can quickly revert the lab using the **load\_config\_on\_nodes.py** script.
```
python3 load_config_on_nodes.py --lab_dir three-routers --config_filename basic.addressing.cfg
```
### Lab
Connect to R1, and configure a local log file called `config-commands` with these properties:
* All commands entered in configuration mode should be captured in this log file. No other logs should be captured.
* The log file should be a max of 100KB
* 3 files of max size should be retained.
* Ensure all users can read the file.
### Answer
Expand to reveal
```
set system syslog file config-commands change-log any
set system syslog file config-commands archive size 100000
set system syslog file config-commands archive files 3
set system syslog file config-commands archive world-readable
```
\
You can test this as follows:
```
[edit]
admin@R1# set system host-name NEW-UNCOMMITTED-CHANGE
[edit]
admin@R1# run show log config-commands
Jul 16 17:08:30 R1 mgd[21740]: UI_CFG_AUDIT_SET: User 'admin' set: [system host-name] "R1 -- "NEW-UNCOMMITTED-CHANGE"
[edit]
admin@R1#
```
### Explanation
Expand to reveal
All system logging is configured under the `system syslog` hierarchy. Local logging has a "destination" of a local filename, instead of a remote server or user terminal. (We saw the latter two in the *Basic System Settings* lab).
\
By default, there are two local log files configured: `interactive-commands` and `messages`. We actually can't see this right now in the configuration, as it seems that containerlab removes this configuration when the container is spun up. But we can see this if we load the factory-default config:
```
[edit]
admin@R1# load factory-default
warning: activating factory configuration
[edit]
admin@R1# show system syslog
file interactive-commands {
interactive-commands any;
}
file messages {
any notice;
authorization info;
}
```
\
The default file sizes and number of files for these two log files differs based on platform. When the file size is exceeded, the file is rotated and moved to `filename.0.gz`. The point at which the file is rotated is controlled with the `archive size ` command. The maximum number of rotation files kept is controlled with the `archive files ` command.
\
The facility of `config-commands` is what is used to solve this lab. This matches logs that are generated whenever a user enters a command in config mode - not upon `commit`, but simply upon changing the candidate config.
\
The `world-readable` command changes the log file permissions to allow all users to read the file. From the Juniper documentation:
> `world-readable` enables all users to read log files. To restore the default permissions, include the `no-world-readable` statement.
\
Log files are stored in /var/log. You can view logs using `show log `.
\
If you want to watch logs in real time (like the equivalent of IOS `term mon`), you can use `monitor start ` and `monitor stop` to stop.
\
Also note that you have built-in help for syslog messages directly within the CLI. You can lookup the message code using `help syslog `. For example:
```
admin@R1> help syslog RPD_OSPF_NBRDOWN
Name: RPD_OSPF_NBRDOWN
Message: OSPF neighbor (realm area i) state changed from to due to (event reason: )
Help: OSPF neighbor adjacency was terminated
Description: An OSPF adjacency with the indicated neighboring router was terminated. The local router no longer exchanges routing information with, or directs traffic to, the neighboring router.
Type: Event: This message reports an event, not an error
Severity: notice
Facility: LOG_DAEMON
Action: For more information, see KB19074.
```
### Further Reading