For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

fmartos_30060's avatar
fmartos_30060
Icon for Nimbostratus rankNimbostratus
May 05, 2010

Audit logging

Hi     I've configured an external syslog, and I'm getting the syslog full of messages like this:     httpd[12864]: 01070417:0: AUDIT - user admin - RAW: httpd(mod_auth_pa...
management
monitoring
hoolio's avatar
hoolio
Icon for Cirrostratus rankCirrostratus
May 06, 2010
That looks like audit logging from the admin GUI's httpd. You could create a filter on syslog-ng to not send the audit logs remotely. For 9.4.2 or higher, you can check this article and recent post for details:

 

 

Customizing syslog-ng f_local0 filter

 

http://devcentral.f5.com/tabid/1082223/aff/32/afv/topic/aft/1172264/afc/1172992/Default.aspx

 

 

Custom Syslog Config

 

http://devcentral.f5.com/Tutorials/TechTips/tabid/63/articleType/ArticleView/articleId/155/LTM-942-Custom-Syslog-Configuration.aspx

 

 

Aaron