For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

fmartos_30060's avatar
fmartos_30060
Icon for Nimbostratus rankNimbostratus
May 05, 2010

Audit logging

Hi     I've configured an external syslog, and I'm getting the syslog full of messages like this:     httpd[12864]: 01070417:0: AUDIT - user admin - RAW: httpd(mod_auth_pa...
management
monitoring
jba3126's avatar
jba3126
Icon for Cirrostratus rankCirrostratus
Jun 03, 2011
I tried this solution ( http://support.f5.com/kb/en-us/solutions/public/9000/400/sol9442.html) provided by F5 for filtering the Config Sync Detect events.

 

5/25/11

 

12:21:25.000 PM May 25 12:21:25 10.1.29.55 May 25 12:21:25 LAB-Practice-LB2 logger: [ssl_req][25/May/2011:12:21:25 -0400] 10.1.29.54 TLSv1 DHE-RSA-AES256-SHA "POST /iControl/iControlPortal.cgi HTTP/1.1" 437

 

host=10.1.29.55 LAB - NDC-PBN-TLP-LB2 Options| sourcetype=syslog Options| source=Syslogs Options

 

 

 

The problem with this solution is when you sync the configuration it overwrites the peer address being filtered.