For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

JoshBecigneul's avatar
JoshBecigneul
Icon for MVP rankMVP
Oct 17, 2012

F5 BigIP v11 and Syslog over TCP

Hi All, I'm currently trying to configure syslog offloading and I'd like to know if there is a way through the UI (or tmsh) of setting the outbound transport to run over TCP. We don't use UDP in our environment, and I'd rather not have to manually edit the syslog-ng.conf file.

 

Ideas?

 

Thanks,

 

Josh Becigneul

 

management
monitoring

3 Replies

  • hoolio's avatar
    hoolio
    Icon for Cirrostratus rankCirrostratus
    Oct 18, 2012
    Hi Josh,

    I think you'll need to use tmsh to import a custom syslog-ng configuration stanza. This default command doesn't seem to support a protocol property: 

    
modify /sys syslog remote-servers add { {host  remote-port }}

    Here's a solution from Alscion:

    http://devcentral.f5.com/Community/GroupDetails/tabid/1082223/aff/32/afv/topic/aft/2159228/afc/2235755/Default.aspx

    tmsh modify sys syslog include "destination remote_server {tcp(\"10.1.0.100\" port (514));};filter f_alllogs {level (debug...emerg);};log {source(local);filter(f_alllogs);destination(remote_server);};"

    Aaron
  • JoshBecigneul's avatar
    JoshBecigneul
    Icon for MVP rankMVP
    Oct 19, 2012
    Thanks Aaron, this did the trick. I'm seeing logs on our log host for this unit now! I've opened a case with F5 support to see if this can be added as a UI option in a future release.
  • JoshBecigneul's avatar
    JoshBecigneul
    Icon for MVP rankMVP
    Mar 20, 2014

    Andrew, You could probably do something like this. Just double up the destination and log statements. (This is untested, fyi)

    tmsh modify sys syslog include "destination remote_server {tcp(\"10.1.0.100\" port (514));};filter f_alllogs {level (debug...emerg);};log {source(local);filter(f_alllogs);destination(remote_server);};destination remote_server2 {tcp(\"10.1.0.102\" port (514));};log {source(local);filter(f_alllogs);destination(remote_server2);};"