BIG-IP SysLog appearing in ossec.log

F5 BigIP Syslog Integration: Logs Appearing in ossec.log instead of archives.log with Size Limitation Error

Environment

• Wazuh server
• F5 BigIP

Current Setup

F5 BigIP is configured to send logs via syslog since running a Wazuh agent is not possible (BigIP standard practices restrict installing new packages).

Issue Description

When sending logs from F5 BigIP to Wazuh using syslog:

1. Logs are appearing in ossec.log instead of archives.log as specified in the official documentation
2. The logs are being received in hexadecimal format
3. The logs appear to be incomplete with an error message indicating "to big size above"

Current Configurations

Wazuh Configuration

F5 BigIP Syslog Configuration

Expected Behavior

1. Logs should be written to archives.log
2. Logs should be complete and properly decoded
3. No size limitation errors should occur

Actual Behavior

1. Logs are being written to ossec.log
2. Logs are in hexadecimal format
3. Receiving error: "to big size above"
4. Logs are incomplete

Troubleshooting Steps Attempted

1. Network Connectivity Verification:
   • Performed tcpdump analysis - confirmed packets are being transmitted correctly
   • No network-level issues identified
2. Wazuh Configuration Adjustments:
   • Modified client_buffer settings - no impact on the issue
   • Tested multiple port configurations - issue persists
3. Port Testing:
   • Attempted communication through different ports
   • Issue remained consistent across all port configurations
4. Additional Attempts:
   • Exhausted various other configuration combinations
   • No successful resolution achieved through standard troubleshooting methods

Debug Information

Decoded Hex Log Sample

Additional Notes

• The incomplete hex format suggests potential issues with message size limitations or parsing
• Willing to provide additional information or troubleshooting details through a call if needed

Questions

1. Is this a known issue with F5 BigIP syslog integration?
2. Are there specific size limitations that need to be configured?
3. Is there a configuration parameter that needs to be modified to direct logs to archives.log?