X10 DividendLog Samples
Juniper SRX
Juniper SRX RT_FLOW session logs in structured and traditional format.
Source: Juniper KB28508 — structured vs traditional syslog. SRX writes the same session event in either format. The choice drives the size.
Structured (RFC 5424)
Named fields, title="value". Stripping field names cuts about 65%.
<14>1 2013-11-04T16:23:09.264Z cixi RT_FLOW - RT_FLOW_SESSION_CREATE [junos@2636.1.1.1.2.35 source-address="50.0.0.100" source-port="24065" destination-address="30.0.0.100" destination-port="768" service-name="icmp" nat-source-address="50.0.0.100" nat-source-port="24065" nat-destination-address="30.0.0.100" nat-destination-port="768" src-nat-rule-name="None" dst-nat-rule-name="None" protocol-id="1" policy-name="alg-policy" source-zone-name="untrust" destination-zone-name="trust" session-id-32="100000165" username="N/A" roles="N/A" packet-incoming-interface="reth2.0" application="UNKNOWN" nested-application="UNKNOWN" encrypted="UNKNOWN"]Traditional (RFC 3164)
The same event, positional. Already minimal — no field names to strip.
Nov 4 16:23:09 cixi RT_FLOW: RT_FLOW_SESSION_CREATE: session created 50.0.0.100/24065->30.0.0.100/768 icmp 50.0.0.100/24065->30.0.0.100/768 None None 1 alg-policy untrust trust 100000165 N/A(N/A) reth2.0 UNKNOWN UNKNOWN UNKNOWNThe structured line is 644 characters; the traditional line holds the same data in 227. The named-field format carries the field name on every value, so it is both larger on the wire and where the reformatting lever returns most. SRX writes one of these at session create and one at close, so the session-start lever applies on top.