Forum Discussion
Ahmed_Aboelmagd
Altostratus
AltostratusHow can I log traffic from specific IP locally and did not send its logs to Rsyslog in the same time
Dears, Actually I integrated our Big-IP with logryhthm as a Rsyslog to make our F5 send its logs (LTM and ASM) to logryhthm. My question here is how I can log traffic for specific IP locally on F5 ...
VernonWells
Employee
EmployeeAhmed, are you trying to send logs for some traffic locally to a BIG-IP log file (i.e., in /var/log) and all other logs to a remote destination?
Ahmed_AboelmagdAltostratus
AltostratusHi Vernon,
Yes you can consider it as you understand, but let me clarify more for better understanding.
Actually, we have Entuity server (a network monitoring software) that checks a web portal behind our F5 every 5 seconds. it gives us a false positive alert (hitting in attack signature) on f5 while Entuity check the login page of the portal. So we need to log all traffic that arrives from Entuity locally on F5 but in the same time we need F5 exclude Entuity traffic from logging remotly on Logryhthm.
Many thanks for your reply.