Forum Discussion

Cirrocumulus

Sep 10, 2024

BIG-IP syslog include

BIG-IP remote syslog with short names, iso dates, and milli/microseconds It looks like syslog-ng is broken on a number of BIG-IP releases. Using use_fqdn(no) still gets fqdns in the logs. This loo...

devops

Jmtaylor
Sep 12, 2024
We have validated this on Version 17.x and are working on other versions as well. Here is the link to the article.
Using use_fqdn(no) in syslog configuration still includes the hostname/FQDN in the logs. (f5.com)

TimRiker

Cirrocumulus

Sep 11, 2024

I'm happy to have this exposed as "Solution". Perhaps with a shorter title.😀I edited the original.

I updated it with frac_digits(6); to get microseconds as the logger seems to support that.

Output from F5s does NOT appear to be RFC5424 compliant with this change. For example, I see an ascii level indicator which rfc5424 does not include. I'm looking into further validation.

The F5s should really have built in support to log in rfc5424 with short names, timezone and milli/microsecond information. Supporting only fqdn and only rfc3164 is pretty lame in this day and age.

There are a few F5 KB articles that recommend adding udp() to syslog include. udp() has been deprecated for a long time now. Any KB references that include that should be updated.

BIG-IP 15.1.10.3 includes syslog-ng 3.8.1 which no longer has reliable online documentation that I can find. If F5 is going to continue to ship this old version, they should at least post the documentation online. syslog-ng 3.8.1 shipped on Aug 19, 2016:

https://github.com/syslog-ng/syslog-ng/releases/tag/syslog-ng-3.8.1

LiefZimmerman
Admin
Sep 12, 2024
Unfortunately, for now, I can't see to mark multiple items as Solution.
When I can I will do so for this comment as well.

Thanks again Tim - very helpful.