Forum Discussion

Clavister_36829's avatar
Clavister_36829
Icon for Nimbostratus rankNimbostratus
Jan 17, 2019

Can I retrieve my Logs in LTM for the past days or weeks?

Hi, Can I retrieve my old logs in our LTM? This is because we had a network issue last January 3, but the affected users only requested for the logs last January 8. WHen I checked the logs on our LTM using "tmsh show /sys log ltm" it only showed me the logs and the oldest is from January 9.

 

application delivery
big-ip ltm
f5 logs
LTM
ltm logs
  • RaghavendraSY's avatar
    RaghavendraSY
    Icon for Altostratus rankAltostratus
    Jan 18, 2019

    You configured syslog server on F5 device? if not you will be able to see only one week logs.

     

    You can search all log files using the below command.

     

    zcat /var/log/ltm..gz | grep zcat /var/log/ltm..gz | grep

     

  • Kai_Wilke's avatar
    Kai_Wilke
    Icon for MVP rankMVP
    Jan 18, 2019

    Hi Clavister,

    the web page will only display the current day. To see older logfiles stored on your device could use the 

    (tmsh) show sys log ltm
    command. This approach is much easier to handle than dealing with the individual *.gz archives.

    By default the SYSTEM keeps the logs of the last 8 days (setting can be viewed with 

    (tmos) list sys db logrotate.logage
    ) on your device and deletes daily (during the log-rotate cron.job) the logs which are older than that.

    For further information on how to deal with log-rotate intervalls, maximum log-age and maximum log file numbers check out...

    https://support.f5.com/csp/article/K13367

    Cheers, Kai