For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

magnus78_287184's avatar
magnus78_287184
Icon for Cirrus rankCirrus
Feb 21, 2017

How to alert if pool member is down?

I´m sending syslog to OMS Loganalytics from Bigip to monitoring our bigip´s. What syslog messages are "important" that I should create alerts on? * Pool member down ? * Health of Bigip?  
application delivery
Azure
BIG-IP
cloud
jeff_bailey_316's avatar
jeff_bailey_316
Icon for Nimbostratus rankNimbostratus
Oct 14, 2017

Would you share how you are sending the logs to OMS?

 

  • magnus78_287184's avatar
    magnus78_287184
    Icon for Cirrus rankCirrus
    Oct 22, 2017

    Jeff: We got a syslog-nx server on a linux VM. It´s collecting all logs from bigip. The syslog server got an OMS Log Analytics agent. Our logs are are received as Type=Syslog, but I have seen that it´s possible to use CEF with Cisco ASA. Probably possible to send CEF logs from Bigip to OMS and integrated this with Azure Security Center.

     

    https://github.com/Microsoft/OMS-Agent-for-Linux/blob/master/docs/Security-Events-Preview-Configuration.md

     

    Another option is that probably could work is doing https post directly from irule´s to OMS server without a syslog server.