For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

brad_11440's avatar
brad_11440
Icon for Nimbostratus rankNimbostratus
Aug 01, 2014

High Speed Logging - Send all logs?

I tried configuring the High Speed logging mechanism using the publisher/destination/filter setup as recommended by F5 (11.5.1). However I want to send all logs, not do it on an individual basis using the message ID F5 documents say to configure. Is there a way to make the system HSL act like syslog-ng and just send everything? Can I put a wildcard in the message ID field? I left it blank and it doesn't seem to be working right...

 

4 Replies

  • I tried configuring the High Speed logging mechanism using the publisher/destination/filter setup as recommended by F5 (11.5.1). However I want to send all logs, not do it on an individual basis using the message ID F5 documents say to configure. Is there a way to make the system HSL act like syslog-ng and just send everything? Can I put a wildcard in the message ID field? I left it blank and it doesn't seem to be working right...

     

    Do you try to send all logs under /var/log/* to a syslog server?

     

  • There's no way to specify a directory for HSL. Under the "log filters" configuration section there is a message ID field. It is described as "Specifies the 8-hexadecimal-digit ID number that appears in the log messages that you want the system to log." However I do not want to do this for every log message - I just want to send everything, like you would with the normal syslog-ng configuration. There has to be a way...

     

  • Under the "log filters" configuration section there is a message ID field. It is described as "Specifies the 8-hexadecimal-digit ID number that appears in the log messages that you want the system to log." However I do not want to do this for every log message - I just want to send everything, like you would with the normal syslog-ng configuration.

     

    i think leaving message id blank means no filtering on message id. anyway, i do not get every log message as well.