JN0-106 messages Practice Question

Exhibit

Refer to the exhibit.

root@router# show system syslog
user.info {
    file messages;
}
authorization {
    file interactive-commands;
}

root@router> show log messages | last 10
Jun 15 12:00:01 router xntpd[1234]: time reset +0.1 sec
Jun 15 12:05:00 router sshd[5678]: Accepted password for admin from 10.0.0.1 port 22

Refer to the exhibit. An administrator wants to see authentication-related logs like SSH logins. In the current configuration, which log file contains this information?

⚠ Common exam trap

The trap is that candidates may assume interactive-commands logs authentication events because it records CLI commands, but authentication occurs before command logging begins. The default location for authentication logs is the messages file.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

messages

In Junos, authentication-related logs such as SSH login attempts are recorded by default in the 'messages' log file. This file captures syslog messages for various system events, including authentication successes and failures. The 'interactive-commands' log file only logs user-executed CLI commands after successful login, not the authentication process itself. The 'security' log is intended for firewall and security policy events, and 'utmp' is for user accounting. Therefore, option D is correct.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
utmp
Why it's wrong here
utmp is a traditional Unix file that records currently logged-in users for accounting purposes, such as who is using the system at any given moment. Junos does not use utmp for authentication event logging; instead, it relies on syslog messages. SSH login attempts, whether successful or failed, are written to the default messages log, not utmp.
✗
interactive-commands
Why it's wrong here
The interactive-commands syslog category in Junos captures each CLI command as it is executed by an administrator, including the user, context, and timestamp. This is a session log of actions taken after authentication, not a record of the authentication attempts themselves. To see SSH login events, you must look at the authentication facility, which is routed to the messages file by default, not at interactive-commands.
✗
security
Why it's wrong here
The 'security' syslog category is used for security policy and firewall events, such as traffic permitted or denied by security policies, as well as IDP and ALG logs. Authentication events are classified under the 'authentication' syslog facility, which maps to the default messages log. Merely selecting the security category will not capture SSH login attempts, since those belong to a different facility and destination.
✓
messages
Why this is correct
The 'messages' file is the default syslog destination in Junos that captures a broad range of system events, including authentication and authorization messages. By default, the authentication facility is logged to /var/log/messages, so SSH login attempts (both successful and failed) appear there. This is confirmed by the 'show log messages' command, which reveals entries from sshd that contain 'Accepted password' or 'Failed password'.

Go deeper

JN0-106 messages Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question