For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

VGF5's avatar
VGF5
Icon for Cumulonimbus rankCumulonimbus
Jun 07, 2017

How to check logs

Hi,

 

[root@F5intmgmt:Active:In Sync] log cat ltm Jun 7 03:34:02 F5intmgmt info audit_forwarder: audit_forwarder started.

 

How to check the logs when I get like this ?

 

8 Replies

  • Kevin_K_51432's avatar
    Kevin_K_51432
    Historic F5 Account

    Greetings,

    Are you trying to search a specific date / time?
    tmsh show sys log ltm range 06/07/2017 | grep -i 
    

    For the value, you can use just about any string: 03:34:02, F5intmgmt, info. Or all:

    tmsh show sys log ltm range 06/07/2107 | grep -i '03:34:02\|F5intmgmt\|info'
    

    Hope this helps!

    Kevin
  • VGF5's avatar
    VGF5
    Icon for Cumulonimbus rankCumulonimbus

    Yes. Thank you for the response.

     

    But When I am using for specific and logs as well it showing as below

     

    [root@F5intmgmt:Active:In Sync] log tmsh show sys log ltm range 06/06/2017 | grep -i '02:54:02|F5intmgmt|info' ltm 06-07 02:54:02 info F5intmgmt audit_forwarder: audit_forwarder started.

     

    [root@F5intmgmt:Active:In Sync] log tmsh show sys log ltm range 06/06/2017

     

    Sys::Log

     

  • Kevin_K_51432's avatar
    Kevin_K_51432
    Historic F5 Account

    You're very welcome. Can you do

    tmsh show /sys log ltm range now-1d
    

    I'm not sure if posting that information here would be very secure, but could you ensure there are log entries for that date in the file?

  • VGF5's avatar
    VGF5
    Icon for Cumulonimbus rankCumulonimbus

    Still I am getting the same output and i used tail -f var/log/ltm Even though I am getting the output same.

     

  • Kevin_K_51432's avatar
    Kevin_K_51432
    Historic F5 Account

    Hmm, but if you use grep it works?

    tmsh show sys log ltm range 06/06/2017 | grep 10:
    ltm 06-06 08:10:40 notice one chmand[5669]: AomctlClntDev: missing remote RPC support - initiate AOM software check
    ltm 06-06 10:07:41 notice one chmand[5669]: AomctlClntDev: missing remote RPC support - initiate AOM software check
    ltm 06-06 10:16:18 notice one chmand[5669]: AomctlClntDev: missing remote RPC support - initiate AOM software check
    ltm 06-06 10:42:43 notice one chmand[5669]: AomctlClntDev: missing remote RPC support - initiate AOM software check
    ltm 06-06 10:44:15 notice one chmand[5669]: AomctlClntDev: missing remote RPC support - initiate AOM software check
    ltm 06-06 15:10:06 notice one chmand[5669]: AomctlClntDev: missing remote RPC support - initiate AOM software check
    ltm 06-06 20:10:21 notice one chmand[5669]: AomctlClntDev: missing remote RPC support - initiate AOM software check
    ltm 06-07 08:10:08 notice one chmand[5669]: AomctlClntDev: missing remote RPC support - initiate AOM software check
    
    
  • I am facing the same issue, only shows audit_forwarder started. Can anybody help me here to fix this. I have even removed the remote-logging from box to check if this works but still same.

     

  • Hi,

     

    Were you able to solve this problem.. If yes, Can you please share what we have to perform to fix this issue on LTM.

     

  • when i run the show sys log ltm range. I am getting below error

     

    show sys log ltm range 12/12/2018

    Sys::Log ltm 01-04 03:09:02 info phx-dc1nemolba-vm audit_forwarder: audit_forwarder started. ltm 01-04 07:41:00 err phx-dc1nemolba-vm mcpd[7296]: Configuration error: Invalid mcpd context, folder not found (/var/log)