Forum Discussion

shaikhzaid's avatar
shaikhzaid
Icon for Altocumulus rankAltocumulus
Mar 14, 2023

f5 logs to azure

I have configured my F5 to forward the system, ltm and asm logs to azure sentinel by referring the below resource.

https://community.f5.com/t5/technical-articles/deploying-big-ip-telemetry-streaming-with-azure-sentinel-as-its/ta-p/278738

Under the system metrics settings, the AVR is installed, to push the declaration i need to execute below commands

tmsh modify analytics global-settings { offbox-protocol tcp offbox-tcp-addresses add { 127.0.0.1 } offbox-tcp-port 6514 use-offbox enabled } 
tmsh save /sys config 

 I want to know before executing the above in F5 cli, is there any HA failover or disruption is expected?

Accordingly, i will have to prepare my activity.

My F5 is in Azure cloud deployed as an HA (A-S).

 

application delivery
  • JRahm's avatar
    JRahm
    Icon for Admin rankAdmin
    Mar 17, 2023

    Hi shaikhzaid, it should not cause a problem on the dataplane, however the config save (depending on how big your configuration is) might cause a slight delay in your CLI/GUI/API operations.