Forum Discussion

balcee's avatar
balcee
Icon for Altocumulus rankAltocumulus
Mar 20, 2023

F5 logs - search query

Hi everyone,  I'm looking at the local traffic logs and I'm specifically looking for which users are connected to a specific pool/pool member. I'm seeing the host details in the logs but is it possi...
security
  • PSFletchTheTek's avatar
    PSFletchTheTek
    Mar 20, 2023

    Hi,

    Have you got APM, or just LTM? APM is normally where user sessions come in.
    But if you have LTM, dependant on how your application manages users you might be able to see usernames in the url or http header which you could get a iRule to try to identify and log.
    Other than that, you're really down to application server logs and not the f5.

PSFletchTheTek's avatar
PSFletchTheTek
Icon for MVP rankMVP
Mar 20, 2023

Hi,

Have you got APM, or just LTM? APM is normally where user sessions come in.
But if you have LTM, dependant on how your application manages users you might be able to see usernames in the url or http header which you could get a iRule to try to identify and log.
Other than that, you're really down to application server logs and not the f5.

  • balcee's avatar
    balcee
    Icon for Altocumulus rankAltocumulus
    Mar 21, 2023

    Thanks very much for your response. Yes it's LTM. I'll speak with the server owner and check logs there. Thanks again.