For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

wixxyl_98682's avatar
wixxyl_98682
Icon for Nimbostratus rankNimbostratus
Oct 04, 2012

Best practices for syslog

Dev,   I'm trying to figure out what we should be logging and how to adjust the logging for our syslog server. Has anyone seen a performance hit from the logging? I'd also like some insight into t...
management
monitoring
nitass's avatar
nitass
Icon for Employee rankEmployee
Oct 04, 2012
Oct 3 00:25:01 boydf5 debug crond[14048]: pam_unix(crond:session): session opened for user root by (uid=0)

 

Oct 3 00:25:01 boydf5 info crond[14049]: (root) CMD (/usr/lib/sa/sa1)

 

Oct 3 00:25:01 boydf5 debug crond[14048]: pam_unix(crond:session): session closed for user root

 

Oct 3 00:26:01 boydf5 debug crond[14050]: pam_unix(crond:session): session opened for user syscheck by (uid=0)those messages are from remotesyslog1 configuration (in case of gui, it is system > configuration > remote logging).

 

 

sorry i just noticed you are running 11.x.

 

 

The default syslog levels defined for the BIG-IP system logs apply to only local logs; the syslog levels do not apply to remote syslog servers that were defined using the tmsh modify /sys syslog remote-servers command.sol13333: Filtering log messages sent to remote syslog servers (11.x)

 

http://support.f5.com/kb/en-us/solutions/public/13000/300/sol13333.html