For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Rodrigo_Mori_13's avatar
Rodrigo_Mori_13
Icon for Cirrus rankCirrus
Oct 03, 2017
Solved

Configuring Syslog Server for a Specific Virtual Server

Hi, guys   I have an application in BIG IP, according to the image.   I need all the IPs that have accessed VS_APP1 to be registered on the syslog server.   Someone could help me set this up...
application delivery
BIG-IP
LTM
  • Kevin_K_51432's avatar
    Kevin_K_51432
    Oct 03, 2017

    Greetings,

    I haven't used the virtual server's Request Logging profile much, but was able to create a profile that logs the source IP address of the connecting client:

    https://support.f5.com/kb/en-us/products/big-ip_ltm/manuals/product/bigip-external-monitoring-implementations-11-5-0/1.html

    In the Request profile Template section, I simply entered:

    Client IP is: ${CLIENT_IP}

    And it was sent to the remote syslog:

    14:10:53.969588 IP 10.12.23.120.48392 > 10.12.23.27.514: [|syslog]
        0x0000:  4500 0037 cb69 4000 ff11 6da1 0a0c 1778  E..7.i@...m....x
        0x0010:  0a0c 171b bd08 0202 0023 7989 436c 6965  .........y.Clie
        0x0020:  6e74 2049 5020 6973 3a20 3130 2e31 322e  nt.IP.is:.10.12.
        0x0030:  3235 302e 3133 30                        250.130

    Hope this is useful!

    Kevin

Kevin_K_51432's avatar
Kevin_K_51432
Historic F5 Account
Oct 03, 2017

Greetings,

I haven't used the virtual server's Request Logging profile much, but was able to create a profile that logs the source IP address of the connecting client:

https://support.f5.com/kb/en-us/products/big-ip_ltm/manuals/product/bigip-external-monitoring-implementations-11-5-0/1.html

In the Request profile Template section, I simply entered:

Client IP is: ${CLIENT_IP}

And it was sent to the remote syslog:

14:10:53.969588 IP 10.12.23.120.48392 > 10.12.23.27.514: [|syslog]
        0x0000:  4500 0037 cb69 4000 ff11 6da1 0a0c 1778  E..7.i@...m....x
        0x0010:  0a0c 171b bd08 0202 0023 7989 436c 6965  .........y.Clie
        0x0020:  6e74 2049 5020 6973 3a20 3130 2e31 322e  nt.IP.is:.10.12.
        0x0030:  3235 302e 3133 30                        250.130

Hope this is useful!

Kevin

Kevin_K_51432's avatar
Kevin_K_51432
Historic F5 Account
Oct 04, 2017

Hi Rodrigo,

 

In researching, it seems local0 to local7 are reserved for local use. So a custom application running on the server can log to it's own file. There's probably some simple way to hack remote message using local facility, but I wasn't able to come up with one.

 

The best I could do was add the following line to my rsyslog config:

 

if $fromhost-ip startswith '10.12.23.' then /var/log/local6.log

 

tail -f /var/log/local6.log

 

Oct 4 08:34:54 local6.notice Client IP is: 10.12.250.130

 

Hope this is somewhat helpful, let us know if you come up with something!

 

Thanks,

 

Kevin