For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

pr's avatar
pr
Icon for Nimbostratus rankNimbostratus
May 23, 2017

Ask F5 - Logging doc..

ref : https://support.f5.com/kb/en-us/products/big-ip_ltm/manuals/product/tmos-concepts-11-4-0/11.html

 

"Logging local traffic events"/

 

Many of the events that the BIG-IP system logs are related to local area traffic passing through the BIG-IP system. The BIG-IP system logs the messages for these events in the file /var/log/audit.

 

Hi Guys,

 

Referencing above AskF5 link and the contents , don't you think it should be directory location /var/log/ltm for local traffic related events instead of /var/log/audit as it will be related to users who logged in ???? Or I am thinking it wrong ???

 

application delivery
BIG-IP
LTM

3 Replies

  • pr's avatar
    pr
    Icon for Nimbostratus rankNimbostratus
    May 23, 2017

    /var/log/audit or who made the changes in VS or pools ..

     

  • pr's avatar
    pr
    Icon for Nimbostratus rankNimbostratus
    May 31, 2017

    Can anybody confirm on that , still waiting for inputs from senior moderators..

     

  • Pedro_Haoa's avatar
    Pedro_Haoa
    Ret. Employee
    Jun 01, 2017

    Hi,

     

    In the Audit logging file (/var/log/audit) you could see all user-initiated and system-initiated configuration changes.

     

    In the LTM logging file (/var/log/ltm) you could see all system LTM related events (local0 facility).

     

    I hope this helps.

     

    Pedro