Forum Discussion
draco_184361
Nimbostratus
Oct 29, 2017Hi Regarding logging to arcsight . how do i extend the storage of asm logs for more than 1 day.
We are already logging to remote log server arcsight but we see only for one day in the arcsight ? how do i extend that ?
- samstep
Cirrocumulus
Clearly the problem is in your ArcSight and not in F5. If you are seeing logs in ArcSight the log data has already left the F5 and is stored on ArcSight. If you can't see more than one day's worth of logs in ArcSight you either have a data retention period set to 1 day in ArcSight (which is really bad) or using a filter in ArcSight to show you only the last 24 hours of logs (which is more likely).
Recent Discussions
Related Content
DevCentral Quicklinks
* Getting Started on DevCentral
* Community Guidelines
* Community Terms of Use / EULA
* Community Ranking Explained
* Community Resources
* Contact the DevCentral Team
* Update MFA on account.f5.com
Discover DevCentral Connects