Forum Discussion

CraigM_17826's avatar
CraigM_17826
Icon for Altocumulus rankAltocumulus
Jul 04, 2012

Ayyway to have entries written to /var/log/ltm to a external syslog server?

Hi,     Our company has made the decision to move our various web sites into the cloud. Our cloud provider has given us a partition on some form of BigIP running ver 11. Even though we have "m...
application delivery
dev
devops
iRules
nitass's avatar
nitass
Icon for Employee rankEmployee
Jul 04, 2012

this is my testing.  

 

LTM 9.4.2+: Custom Syslog Configuration by Deb  

https://devcentral.f5.com/s/articles/LTM-9-4-2-Custom-Syslog-Configuration

 

[root@ve10:Active] config  b syslog include
SYSLOG - Include Data: none
 
[root@ve10:Active] config  b syslog include '"
> destination remote_server {
>   udp(\"192.168.206.55\" port (514));
> };
> filter f_rule {
>   match(\"_rule\");
> };
> log {
>   source(s_syslog_pipe);
>   filter(f_local0);
>   filter(f_rule);
>   destination(remote_server);
> };"'
[root@ve10:Active] config  b syslog include
SYSLOG - Include Data:
destination remote_server {
  udp("192.168.206.55" port (514));
};
filter f_rule {
  match("_rule");
};
log {
  source(s_syslog_pipe);
  filter(f_local0);
  filter(f_rule);
  destination(remote_server);
};
 
[root@ve10:Active] config  b rule test_rule list
rule test_rule {
   when CLIENT_ACCEPTED {
   set test "HTTP::uri"
   eval $test
}
 
/var/log/ltm
 
Jul  4 12:43:03 local/tmm err tmm[5111]: 01220001:3: TCL error: test_rule  - Operation not supported (line 2)     invoked from within "HTTP::uri"     ("eval" body line 1)     invoked from within "eval $test"
 
syslog
 
C:\>nc -l -u -p 514
<131>Jul  4 12:43:03 local/tmm err tmm[5111]: 01220001:3: TCL error: test_rule  - Operation not supported (line 2)     invoked from within "HTTP::uri"     ("eval" body line 1)     invoked from within "eval $test"