F5 is upgrading its customer support chat feature on My.F5.com. Chat support will be unavailable from 6am-10am PST on 1/20/26. Refer to K000159584 for details.

Forum Discussion

msmith1356_2932's avatar
msmith1356_2932
Icon for Nimbostratus rankNimbostratus
Jan 05, 2017

Audit Logging to Remote Server

I have been trying to send the audit logs (MCP) to a remote arcsight server. I have set up the remote server pool, log destination (for both the remote server, and the arcsight format), log publisher, and log filter. But i am not seeing any logs being sent.

 

Any ideas?

 

BIG-IP
security

1 Reply

  • msmith1356_2932's avatar
    msmith1356_2932
    Icon for Nimbostratus rankNimbostratus
    Jan 06, 2017

    I figured out that there must be a message ID in place in the Log Filter in order for any logs to be sent.

     

    Now my question is, is there a list somewhere about which logging sources send out what data?

     

    And also, can i put multiple message ID's in the same Log Filter?