Forum Discussion

Cirrostratus

Jan 22, 2020

Solved

Does anyone did traffic logging?

Hi guys I`m searching method which can logging or inspecting traffic information. Target license are LTM and CGNAT. I have looking for Telemetry streaming but that seems providing s...

NUT2889
Jan 22, 2020
Hi,

Yes, the purpose of HSL is for syslog protocol. You can forward to external syslog server by TCP / UDP based on syslog receiver.

NUT2889

Cirrostratus

Jan 22, 2020

Hi,

F5 not suggest to store log locally. From my experience F5 support recommend customer forward log to SIEM / Big Data Solution / BIG-IQ instead.

SWJO
Cirrostratus
Jan 22, 2020
Hi.

Then is there possible method not store logs in box but forward to remote?
- NUT2889
  Cirrostratus
  Jan 22, 2020
  Hi,
  
  Previously message might not clear for you. If we talk about technical perspective.
  If you have security module running on F5 device.
  Logging profile with local log publisher to store on F5 locally.
  Logging profile with remote log publisher forward log to SIEM / Big Data / BIG-IQ
  If you don't have security module on F5 device.
  iRule to generate HSL by sending log to SIEM / Big Data / BIG-IQ
  iRule for log locally
- SWJO
  Cirrostratus
  Jan 22, 2020
  Hi.
  
  I don`t have security module.
  So select 2.
  there are 2 selections.
  before select, I`m first time out HSL.
  Does HSL can send syslog remote not store on BIGIP?
- NUT2889
  Cirrostratus
  Jan 22, 2020
  Hi,
  
  Yes, the purpose of HSL is for syslog protocol. You can forward to external syslog server by TCP / UDP based on syslog receiver.