For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Alan_Roper_2049's avatar
Alan_Roper_2049
Icon for Nimbostratus rankNimbostratus
Sep 21, 2016

Duplicate syslogs being delivered

We have syslog arriving at the F5 via two separate virtual servers using port TCP514 from a single device which is configured to use two syslog servers - The virtual servers then forward the logs to ...
application delivery
LTM
IainThomson85_1's avatar
IainThomson85_1
Icon for Cumulonimbus rankCumulonimbus
Sep 21, 2016

I'm trying to work out what's happening here.

 

  • You have devices out in the field configured with 2 Syslog IP's(Presuming for redundancy?) these are both VIP's that sit on the same F5 Pair?
  • You have two VIP's on the F5, separate IP's, each configured on port 514
  • Behind the VIP's you have a pool which includes your syslog collectors ?

Because your Client devices are sending 2 Syslog instances you're wanting the F5 to include some intelligence to drop one of the requests?

 

Can you not just have one IP configured in the first place, as its the same infrastructure its configured on?

 

Apologies if I've got the wrong message.