How do I setup remote syslog for audit logs only on my f5 big IP

Hi,

I use to setup this in TMSH command line:

# edit /sys syslog
 
modify syslog {
    include "
        filter f_audit {
           match('AUDIT');
        };
        destination d_syslog {
            udp(mysyslog.server.local port(504));
        };
        log {
           source(local);
           filter(f_audit);
           destination(d_syslog);
        };"
}

You can run "modify" intead of "edit" like described here:

https://support.f5.com/csp/article/K13080

Regards.