Forum Discussion
Justkennie_4820
Nimbostratus
NimbostratusBigIP version 10 and logs to remote syslog server
Hi Guys,
I have a bigip 3600 version 10 running. I configure the below command to send syslog to a remote serfer, yet I am not geting the logs on the syslog server.
Checking the traffic on the n...
ShakeelRashid_8Nimbostratus
NimbostratusWas there a solution found to this? I have a very similar problem, I'm running tcpdump on all interfaces (in both bash and TMSH) but I'm finding that the LTM isn't sending out any syslog messages. I've even tried the echo test. I've gone over the routing differences between TMM and mgmt interfaces and everything looks ok, I'm stumped :S
jaikumar_f5MVP
Can you confirm if your syslog setting is set properly. Dont have a v10 version to tell you the commands, is tmsh present in your version ?
tmsh list sys syslog- ShakeelRashid_8
Sorry, I should've mentioned, I'm on v11, not 10. This is what I have configured:
[user@viprion:/S1-green-P:Active:In Sync] ~ tmsh list sys syslog sys syslog { remote-servers { remotesyslog1 { host x.x.x.x } remotesyslog2 { host y.y.y.y } remotesyslog3 { host z.z.z.z } remotesyslog4 { host a.a.a.a } remotesyslog5 { host b.b.b.b } remotesyslog6 { host c.c.c.c } } }
The port isn't showing up here but in the GUI its showing as 514
- jaikumar_f5
Do you have the routes set for the syslog servers,
tmsh list sys management-routeAnd search your syslog servers in it.
- ShakeelRashid_8
Yes I do, the two missing are sitting on the same subnet as the mgmt interface so they're not required:
They're all configured as /32 host routes, the default 0.0.0.0/0 uses the same gateway as the other /32s
[user@viprion:/S1-green-P:Active:In Sync] ~ tmsh list sys management-route sys management-route ArcSight { gateway [GATEWAY] network a.a.a.a/32 } sys management-route SYSLOG2 { gateway [GATEWAY] network c.c.c.c/32 } sys management-route SYSLOG1 { gateway [GATEWAY] network y.y.y.y/32 } sys management-route PRTG { gateway [GATEWAY] network x.x.x.x/32 } sys management-route default { description configured-statically gateway [GATEWAY] network default }
- jaikumar_f5
Interesting, have you also followed through this article already.
- ShakeelRashid_8
Yes mate, followed that as well. Got stuck at the final step:
Using the tcpdump utility to verify that syslog traffic is sent by the BIG-IP system
When manually generating a syslog message, nothing gets sent out to any configured syslog servers. Thought I'd ask the question to see if anyone else has had a similar problem before getting in touch with tech support.
- ShakeelRashid_8
Any thoughts from anyone?