Viewing Real-Time System Logs in Junos
During troubleshooting, an engineer needs to view real-time logging messages on a Junos device. Which command should be used?
Quick Answer
The answer is the `monitor start messages` command. This is the correct choice because it initiates a real-time, tail-like display of the `/var/log/messages` file, allowing an engineer to view real time system logs as new syslog entries are generated on a Junos device. Unlike static commands like `show log messages`, which only display the file’s current contents, `monitor start messages` continuously updates the terminal, making it essential for live troubleshooting. On the JNCIA-Junos exam, this command tests your understanding of operational monitoring versus file viewing; a common trap is confusing it with `monitor traffic` or `show log`, which serve different purposes. The exam expects you to know that `monitor start` is the Junos equivalent of the Linux `tail -f` command for syslog files. A helpful memory tip: think of “monitor” as “watch live,” and “start” as “begin the stream”—so “monitor start” means “start watching the live stream of messages.”
⚠ Common exam trap
It's easy for candidates to confuse 'show log messages' (a static snapshot) with 'monitor start messages' (a live streaming view), because both involve the 'messages' log file, but only the latter provides real-time output.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
monitor start messages
The 'monitor start messages' command enables real-time, tail-like display of the /var/log/messages log file on a Junos device, allowing the engineer to view new log entries as they are generated. This is the correct command for live troubleshooting because it continuously updates the terminal with incoming syslog messages, unlike static file viewing commands.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
file show /var/log/messages
Why it's wrong here
file show /var/log/messages dumps the current file contents once and returns to the prompt, so new entries are missed. It is tempting because it reads the same log file, and would be correct for inspecting historical entries, but real-time viewing requires monitor log messages to stream output continuously.
- ✓
monitor start messages
Why this is correct
monitor start messages streams real-time log messages to the terminal from the messages log file, satisfying the requirement to view live logging. It differs from show log messages, which displays existing entries rather than continuously tailing new output.
- ✗
show log messages
Why it's wrong here
show log messages prints the existing log file contents and exits; it does not follow the file as new entries arrive. It is tempting because it displays log data, and would be correct for reviewing past events, but real-time monitoring requires the monitor log messages command, which streams continuously.
- ✗
traceoptions
Why it's wrong here
traceoptions configures diagnostic tracing to a log file for specified protocols; it does not display live messages on screen. It is tempting because it captures detailed packet-level events, and would be correct when debugging a specific routing process, but viewing real-time logging requires monitoring the log stream instead.
Go deeper
Related to this question
About these practice questions
This JN0-106 question is part of Courseiva's 326-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
3 more ways this is tested on JN0-106
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A network engineer wants to view the OSPF log entries in real time. They type 'show log messages | match ospf' and get output, but it does not update. What should they do to see real-time updates of OSPF log entries?
medium- ✓ A.Use 'monitor start messages | match ospf'
- B.Use 'show log messages | tail'
- C.Use 'monitor traffic interface ge-0/0/0'
- D.Use 'request system syslog'
Why A: The 'monitor start messages' command in Junos OS enables real-time streaming of syslog messages to the terminal, similar to 'tail -f' on a log file. Piping the output through '| match ospf' filters the live feed to show only OSPF-related entries. In contrast, 'show log messages' is a one-time snapshot that does not update automatically.
Variation 2. An engineer wants to view system log messages as they are generated in real-time. Which command should they use?
medium- A.start log messages
- ✓ B.monitor log messages
- C.request system log
- D.show log messages
Why B: The 'monitor log messages' command in Junos OS provides a real-time view of system log messages as they are generated, similar to the 'tail -f' command on Unix systems. It streams new log entries to the terminal without requiring manual refresh, making it ideal for live monitoring of events.
Variation 3. A technician wants to view the system log messages in real time. Which command should they use?
easy- A.show system log
- ✓ B.monitor start messages
- C.start shell
- D.show log messages
Why B: The 'monitor start messages' command is used in Junos OS to display system log messages in real time as they are generated. This is the correct command for live monitoring of system events, similar to 'tail -f' on Unix systems.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This JN0-106 practice question is part of Courseiva's free Juniper Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the JN0-106 exam.