Forum Discussion
NimbostratusF5 LTM 11.3.0(3144) - Syslog remote server problems
Hi all, this problem I'm having is doing my head in!
I only want to receive 'crit' to 'emerg' alerts for the cron syslog alert type, yet I am still seeing 'Info' on my remote syslog server! For the record I have followed these 3 articles:http://support.f5.com/kb/en-us/solutions/public/13000/000/sol13080.html
http://support.f5.com/kb/en-us/solutions/public/13000/300/sol13317.html http://support.f5.com/kb/en-us/solutions/public/13000/300/sol13333.htmlHere's my config:
[root@myf5:Active:Standalone] config tmsh list /sys syslog all-properties
sys syslog {
auth-priv-from notice
auth-priv-to emerg
console-log enabled
cron-from crit
cron-to emerg
daemon-from warning
daemon-to emerg
description none
include none
iso-date disabled
kern-from warning
kern-to emerg
local6-from crit
local6-to emerg
mail-from err
mail-to emerg
messages-from err
messages-to crit
remote-servers {
zenoss {
description none
host 10.140.31.6
local-ip 192.168.1.2
remote-port 514
}
}
user-log-from crit
user-log-to emerg
}
This all looks perfect to me, so I don't understand why I'm seeing these Informational cron alerts. An example alert still coming through is:
(syscheck) CMD (/usr/bin/system_check -q)
What am I doing wrong? Any help would be hugely appreciated as it's so frustrating.
Thanks10 Replies
- nitass
Employee
I only want to receive 'crit' to 'emerg' alerts for the cron syslog alert type, yet I am still seeing 'Info' on my remote syslog server!
i remember the level configuration is applied to local log file only. for remote syslog, you have to filter using syslog include.
Mark_35110Thanks, I did have everything via a 'syslog include' but saw no option to bind the alerts to an IP address of my choice. That's why I moved to the remote-servers part of syslog config. If you can let me know how to bind to a local-ip via the include statement then I will be forever in your debt :)
nitass_89166Noctilucent
I only want to receive 'crit' to 'emerg' alerts for the cron syslog alert type, yet I am still seeing 'Info' on my remote syslog server!
i remember the level configuration is applied to local log file only. for remote syslog, you have to filter using syslog include.
- Mark_35110Thanks, I did have everything via a 'syslog include' but saw no option to bind the alerts to an IP address of my choice. That's why I moved to the remote-servers part of syslog config. If you can let me know how to bind to a local-ip via the include statement then I will be forever in your debt :)
- nitass
can you try something like this?
root@(ve11a)(cfg-sync In Sync)(Active)(/Common)(tmos) list sys syslog include sys syslog { include " filter f_remote_loghost { level(crit..emerg); }; destination d_loghost { udp(\"172.28.24.1\" port(514) localip(172.28.24.11)); }; log { source(s_syslog_pipe); filter(f_remote_loghost); destination(d_loghost); }; " } - Mark_35110
Fantastic, that has now stopped all those annoying alarms :D
Now, how can I force a test alert to prove this worked 100%? - nitass_89166
Now, how can I force a test alert to prove this worked 100%?
is logger command useful?
sol11127: Testing SNMP traps on BIG-IP (9.4.x - 11.x)
http://support.f5.com/kb/en-us/solutions/public/11000/100/sol11127.htmlby the way, just in case you have not seen this article.
LTM 9.4.2+: Custom Syslog Configuration by Deb Allen
https://devcentral.f5.com/articles/ltm-942-custom-syslog-configuration.UvOYGLSjZQIhope it helps.
- Mark_35110Thanks for the links - useful! My problem is resolved, I hope this thread helps someone else in the future :)
- nitass
Now, how can I force a test alert to prove this worked 100%?
is logger command useful?
sol11127: Testing SNMP traps on BIG-IP (9.4.x - 11.x)
http://support.f5.com/kb/en-us/solutions/public/11000/100/sol11127.html
by the way, just in case you have not seen this article.
LTM 9.4.2+: Custom Syslog Configuration by Deb Allen
https://devcentral.f5.com/s/articles/LTM-9-4-2-Custom-Syslog-Configuration
hope it helps.
- Mark_35110Thanks for the links - useful! My problem is resolved, I hope this thread helps someone else in the future :)
