Forum Discussion
Detecting and reporting LTM object configuration changes
From carefully reading all posts related to this subject it would appear that audit logging is the preferred way to detect configuration changes (versus diffing configs). Has anyone developed an eff...
I've done some experimenting with filtering and still falling short. I devised a simple compound 'or' filter based on actual output from /var/log/audit. While this is far from a complete solution, I should still see matches for adding, deleting or modifying a Virtual Server. Instead I see a regular messages about the device groups.
Here's my attempt at the filter:
include "source s_audit { file(/var/log/audit); }; destination d_filtered_audit { file(/var/log/filtered_audit); }; filter f_match { match ('create') or match ('obj_delete') or match ('modify'); }; log {source(s_audit);filter(f_match);destination(d_filtered_audit); };"
