For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Terry_77423's avatar
Terry_77423
Icon for Altostratus rankAltostratus
Oct 07, 2016

AAM and HSL to splunk

We are in the process of adding AAM to our corporate webserver. Currently we log centrally log our webservers for analytics. When we introduce AAM these logs will not necessarily be a true represe...
AAM
application delivery
hsl
LTM
splunk
Terrence's avatar
Terrence
Icon for Nimbostratus rankNimbostratus
Oct 12, 2016

So I managed to figure this out using a vip-to-vip configuration, with the splunk-f5 irule on the outside vip and wam configured on the inside vip. A couple of additional things

 

The inside vip sets some HTTP headers when HTTP_RESPONSE which passes pool,node, and vip information to the outside vip.

 

The outside vip does the splunk hsl logging in HTTP_RESPONSE. I also added x_wa_info to the logs

 

The inside vip logs lb_fails.

 

This is the only way I managed to get consistent logging with wam.