Forum Discussion

Cirrus

Feb 21, 2017

How to alert if pool member is down?

I´m sending syslog to OMS Loganalytics from Bigip to monitoring our bigip´s. What syslog messages are "important" that I should create alerts on? * Pool member down ? * Health of Bigip?

Nimbostratus

Oct 14, 2017

Would you share how you are sending the logs to OMS?

magnus78_287184

Cirrus

Oct 22, 2017

Jeff: We got a syslog-nx server on a linux VM. It´s collecting all logs from bigip. The syslog server got an OMS Log Analytics agent. Our logs are are received as Type=Syslog, but I have seen that it´s possible to use CEF with Cisco ASA. Probably possible to send CEF logs from Bigip to OMS and integrated this with Azure Security Center.

https://github.com/Microsoft/OMS-Agent-for-Linux/blob/master/docs/Security-Events-Preview-Configuration.md

Another option is that probably could work is doing https post directly from irule´s to OMS server without a syslog server.