For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

msmith1356_2932's avatar
msmith1356_2932
Icon for Nimbostratus rankNimbostratus
Jan 05, 2017

Audit Logging to Remote Server

I have been trying to send the audit logs (MCP) to a remote arcsight server. I have set up the remote server pool, log destination (for both the remote server, and the arcsight format), log publisher, and log filter. But i am not seeing any logs being sent.

 

Any ideas?

 

BIG-IP
security

1 Reply

  • msmith1356_2932's avatar
    msmith1356_2932
    Icon for Nimbostratus rankNimbostratus
    Jan 06, 2017

    I figured out that there must be a message ID in place in the Log Filter in order for any logs to be sent.

     

    Now my question is, is there a list somewhere about which logging sources send out what data?

     

    And also, can i put multiple message ID's in the same Log Filter?