Forum Discussion

JD1's avatar
JD1
Icon for Altostratus rankAltostratus
Feb 04, 2015

High Speed Logging - Not working quite as expected (Specific to ArcSight)

Introduction I'm wondering if anyone can offer any advice on how this should be working and whether I'm getting the wrong understanding of this.   To be clear, it is not the iRule HSL implementat...
arcsight
high speed logging
management
remote logging
security
Brett_Williams1's avatar
Brett_Williams1
Icon for Nimbostratus rankNimbostratus
Aug 25, 2015

Sorry to resurrect this thread, but I also have been having some interesting challenges with HSL. We also have ArcSight, and our people also requested CEF. However, when I configured HSL for this and pointed it to a POC syslog server, I was getting useless information... just a couple hex phrases, and they were all the same.

 

So I dug a little deeper... we are running GTM, LTM and APM... none of those modules contribute anything meaningful to ArcSight. The ArcSight log format is meant for ASM and AFM. Since we are not using those, we are simply sending unformatted syslog and our SIEM folks are happy.

 

On the other hand, the ins and outs of HSL are still a bit of a mystery. Some of our devices have mysteriously stopped behaving the way they are configured... however that is a different discussion for a different time.