For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

mustard123_1489's avatar
mustard123_1489
Icon for Nimbostratus rankNimbostratus
Jun 06, 2014

BIG IP Status Codes

I am looking to get a list of the status codes and type of event they refer to for F5 BIG IP.

 

Ex: Jun 3 21:37:19 xxx.xxx.xxx.xxx notice tmm2[9409]: 01490500:5: 9da83f0c: New session from client IP xxx.xxx.xxx.xxx (ST=xxx/CC=xxx/C=xxx) at VIP xxx.xxx.xxx.xxx Listener /Common/xxx_F5_vs (Reputation=Unknown) Jun 4 10:36:19 xxx.xxx.xxx.xxx notice tmm1[9408]: 01490544:5: af42c122: Received client info - Type: IE Version: 7 Platform: WinNT CPU: unknown UI Mode: Full Javascript Support: 1 ActiveX Support: 1 Plugin Support: 0 Jun 4 10:35:55 xxx.xxx.xxx.xxx notice tmm1[9408]: 01490502:5: 7715dfd1: Session deleted due to user inactivity or errors.

 

I believe what I am looking for would be this section:

 

01490500:5: 9da83f0c

 

event:severity: sub code?

 

I am working on a parser, but need to know what event each status code refers to. I found an example here: AskF5 Home > Products > BIG-IP LTM > BIG-IP Network and System Management Guide > Logging BIG-IP System Events "Logging local traffic events"

 

But have been unable to find a complete list. I do not have access to the BIG IP myself, only the logs I am sent.

 

Any help would be appreciated. Thank you.

 

3 Replies

  • VernonWells's avatar
    VernonWells
    Icon for Employee rankEmployee
    Jun 22, 2014

    On 11.x systems at least, the file /config/httpd/run/bigip_error_maps.dat appears to contain a complete map. The :n: does appear to correspond to the severity level. They appear to map as:

    1. Emergency
    2. Alert
    3. Critical
    4. Error
    5. Warning
    6. Notice
    7. Informational
    8. Debug

    This solution article provides some information:

    http://support.f5.com/kb/en-us/solutions/public/6000/400/sol6420.html

    The integers mentioned in that article correspond to entries in the .dat file, not the integers between the colons (:) in the messages. I suspect the hex value after the second colon is a serial number for the error, rather than a sub-code.

    Note that the only documentation I've found is in that solution article, so you will need to open a case with F5 Support to verify that my speculation is indeed accurate.

    It sounds like you'd like somebody to send you the file I reference, but I don't know whether that is something that can be publicly shared. Once again, opening an F5 Support case will provide information about that.