Please let me know how do we check logs on F5 for troubleshooting purpose

editors note: Updating the link (Removing a redirect) to the new MyF5 home for same. -lz---I'd suggest to check the MyF5 article - K16197: Reviewing BIG-IP log fileshttps://my.f5.com/manage/s/article/K16197 It covers the log reviewing basis of various interfaces and includes tmsh examples/videos for time filtering. Thanks.

How to Check logs on F5 for troubleshooting purpose.

Sean_Chao
Employee
Aug 06, 2020
editors note: Updating the link (Removing a redirect) to the new MyF5 home for same. -lz
---
I'd suggest to check the MyF5 article - K16197: Reviewing BIG-IP log files
https://my.f5.com/manage/s/article/K16197

It covers the log reviewing basis of various interfaces and includes tmsh examples/videos for time filtering. Thanks.
LiefZimmerman
Admin
May 14, 2020
This question gets a lot of views in our community. If any of these answers address your question please select it as best - if you discovered some combination of them to fix your problem it would be great to condense that back into one answer we can highlight as 'best'. Thanks.
DineshVM_265886
Altostratus
Jun 21, 2017
You can view the logs using the below command in cli

tail /var/log/ltm ----- Shows the last few lines of the latest logs cat /var/log/ltm ----- Shows the complete log of the present day cat /var/log/ltm.* ----- Shows the logs for any of the previous days unto one week.

Alternatively, you can view the logs in GUI under SYSTEM --> Logs.

Let me know if this answer was helpful.
NickAD
Cirrus
Jun 21, 2017
Hey Imran, it depends exactly which type of logs you are looking for.

If you are logged in to the web console, you can go to Security > Event Logs.

However, because you are troubleshooting, it sounds like maybe you are needing the LTM logs (since that is where my troubleshooting steps usually go to).

If you log in to your box via SSH, you can type "tmsh" to switch to your virtual terminal. From here, type "show /sys log type" replacing 'type' with the type of log you are looking for. You can type "show /sys log all" to view the different types of logs. For instance you can use "show /sys log ltm" which for me has helped a lot.

From outside of tmsh, you can just cd to /var/log to see multiple log files. The equivalent of viewing the LTM log would be "tail /var/log/ltm"

Hope that helps!
LoyalSoldier
Altostratus
Jun 21, 2017
You can also add the -f option for showing logs as they are added for live troubleshooting:

tail -f /var/log/ltm
Rebecca_Moloney
Admin
Apr 17, 2023
Glad you were able to find a solution! Here's a related Technical Article by JRahm which may help folks who land on this post wanting to learn more: Getting Started with iRules: Logging & Comments.
immu
Altostratus
Jun 21, 2017
Really appreciate the answers give by all...but if I need to filter the logs for one particular day and time then how can do it..

Thanks in advance
- JRahm
  Admin
  Mar 10, 2021
  If you want particular days, say March 9th-10th, from the command line:
  
  tmsh show /sys log ltm range 2021-03-09--2021-03-10
  
  If you want the last couple of days:
  
  tmsh show /sys log ltm range now-2d
  
  Or if you want specific times on a particular day, say March 10th between 6-8am, you might just hit the log file directly with grep:
  
  [root@ltm3:Active:Standalone] log # grep ^Mar.10.0[68].* /var/log/ltm Mar 10 06:51:29 ltm3 warning tmm1[45470]: 01010040:4: Clock has unexpectedly adjusted by 3624277 ms Mar 10 06:51:30 ltm3 notice tmm[45470]: 01010029:5: Clock advanced by 1204 ticks Mar 10 06:51:31 ltm3 warning tmm[45470]: 01010040:4: Clock has unexpectedly adjusted by 3624277 ms Mar 10 08:04:55 ltm3 warning tmm[45470]: 01010040:4: Clock has unexpectedly adjusted by 26551016 ms Mar 10 08:04:57 ltm3 warning tmm1[45470]: 01010040:4: Clock has unexpectedly adjusted by 26551016 ms
- lttarvina
  Cirrus
  Jul 03, 2022
  1) Upload a fresh qkviews to F5 iHealth.
  2) Click on the uploaded qkview to view its contents, then go to Files > log.
  3) Search for the date (on the right side) that a qkview file encountered a problem under the Viewing Filepath.
  4) To read the contents of the var/log/ltm file, click the link for that specific file. You can then determine what caused the problem.
dragonflymr
Cirrostratus
Jun 21, 2017
Hi,

What about something like that:

show sys log ltm range [date]

check help time for possible definitions of [date]

Piotr