BIG-IP 11.4 LTM - Connection logging

How can I see current connections on LTM system including SNAT translations (Original source IP and port), connections torward server etc.

have you tried "tmsh show sys connection all-properties"?

Also is there any way to send this informations to remote server (over syslog, SNMP etc.)?

you can get ip and port using IP::local_addr, IP::remote_addr, TCP::local_port, TCP::remote_port and send it using high speed logging.

high speed logging

Thank you for response.

I configured HSL, Request Logging profile and associate prifile with virtal server.

In Template field i wrote down CLIENT_IP,CLIENT_PORT;SNAT_IP,SNAT_PORT, but in syslog I got just theese text, not real values (IP addresses and ports).

Is there any special syntax for configuring template under Request Logging?

Was there any performance impact ? did you measure the latency due to HSL logging?

For now I didn't see any performace problem, but system is not in full production yet.

In the meantime, I found correct syntax for Request Logging, "$" sign must be used, for example: $CLIENT_IP,$CLIENT_PORT;$SNAT_IP,$SNAT_PORT

Now I have another problem... :-)

If I use template $CLIENT_IP,$CLIENT_PORT;$SNAT_IP,$SNAT_PORT I see correct informations, but if i add date and time before ($DATE_NCSA,$CLIENT_IP,$CLIENT_PORT;$SNAT_IP,$SNAT_PORT) syslog information is cutted like in picture below (you can see date, time, source IP and port and part od SNAT IP and no SNAT port:

Is it possible to send all informations, without cutting and put sometnihg in place of "unknown"?

but if i add date and time before ($DATE_NCSA,$CLIENT_IP,$CLIENT_PORT;$SNAT_IP,$SNAT_PORT) syslog information is cutted like in picture below (you can see date, time, source IP and port and part od SNAT IP and no SNAT port

what tcpdump command did you use? was -s0 included?

have you checked log in syslog server? i think log in syslog may be complete.

Hello Folks,

I have same requirement. We want to forward connection session information to syslog server. Could you please help me to achieve this. I want to know the steps required for this.

Please.

Thanks

Hello guys,

antoher question regarding logging.

We are doing some TCP optimization and we'd need to log connections.

O.K., it's not problem with SRC & DST IP and PORT, but we also need:

IP Protocol ID

duration of session

amount of uploaded data per connection

amount of downloaded data per connection

I looked at Configuring Request Logging, but didn't find any of those.

Is this even possible just with TCP profile on BIG-IP?

BR, Mate

Any update on this?

Need this