Forum Discussion

JD1's avatar
JD1
Icon for Altostratus rankAltostratus
Feb 04, 2015

High Speed Logging - Not working quite as expected (Specific to ArcSight)

Introduction I'm wondering if anyone can offer any advice on how this should be working and whether I'm getting the wrong understanding of this.   To be clear, it is not the iRule HSL implementat...
arcsight
high speed logging
management
remote logging
security
Seth_Cooper's avatar
Seth_Cooper
Icon for Employee rankEmployee
Feb 04, 2015

Hi JD,

 

First thing I want to point out is that you should not run your device with Debug logging turned on in production. Debug logging is very verbose and will affect performance. Debug logging is designed for support/development to troubleshoot issues not for normal log level.

 

Not sure if you need HSL... I assume that ArcSight can be setup to listen on UDP 514 for syslog traffic? If so just point the F5 to remote log. Under "System > Logs > Configuration > Remote Logging" just add your IP address of the syslog server. The log entries will be sent in standard syslog format which ArcSight should be able to consume.

 

If you do it this way then all the logs will be shipped off and you don't have to worry about setting up HSL.

 

Regards,

 

Seth