For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Tabish_Mirza_12's avatar
Tabish_Mirza_12
Icon for Nimbostratus rankNimbostratus
Jun 24, 2014

F5 LTM 11.3.1 session connection logs

Hello Folks,   We have VS configured with SNAT. We can see users connection session logs on BIGIP but we want to forwards these log to remote syslog server. How can we achieve this? We have alread...
application delivery
LTM
management
Kevin_Stewart's avatar
Kevin_Stewart
Icon for Employee rankEmployee
Jun 24, 2014

Not sure if you need to log everything from tmsh show connection, but the following iRule will log client, VIP, and server IP/port to a remote syslog server:

when CLIENT_ACCEPTED {
    set vs [IP::local_addr]:[TCP::local_port]

    set hsl [HSL::open -proto UDP -pool syslog-ubuntu-pool]
}
when SERVER_CONNECTED {
    set client [IP::client_addr]:[TCP::client_port]
    set srv [IP::remote_addr]:[TCP::remote_port]

    HSL::send $hsl "<134>Client: $client established a connection to $vs and load balanced to server $srv at [clock format [clock seconds] -format "%Y-%m-%d %H:%M:%S"]"
}

This will trigger a log on every server side connection. If you want to actually log per-request traffic, you can still use an iRule, but you also have the Request Logging profile, which would be applied to the virtual server and log every request and/or response.