For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Alan_Roper_2049's avatar
Alan_Roper_2049
Icon for Nimbostratus rankNimbostratus
Sep 21, 2016

Duplicate syslogs being delivered

We have syslog arriving at the F5 via two separate virtual servers using port TCP514 from a single device which is configured to use two syslog servers - The virtual servers then forward the logs to ...
application delivery
LTM
Alan_Roper_2049's avatar
Alan_Roper_2049
Icon for Nimbostratus rankNimbostratus
Sep 21, 2016

Thanks for the suggestions, after discussing the issue with the SIEM team the duplication issue looks to be down to how the collectors receive the logs. If all the logs got to one collector then it can de-dupe them, if logs are received over multiple collectors that's when the issue occurs. So an initial solution is to see if having the pool members prioritised so traffic is only forwarded to one collector at a time until the highest priority one fails will resolve the issue.

 

Thanks again

 

Alan