Forum Discussion
CirrostratusHow to identify who remove the Virtual server
How to identify who remove the Virtual server from LB,
spalandeNacreous
From Bash shell:
cat /var/log/audit | grep "name_of_vs"
cat /var/log/audit.1 | grep "name_of_vs"
zcat /var/log/audit.*.gz | grep "name_of_vs"
From GUI:
Sytem -> Logs --> Audit --> search with VS name (date/time range can also be provided)
GajjiFrom GUI:
Sytem -> Logs --> Audit --> search with VS name (date/time range can also be provided)
How to use it?
i am using any name on name filed and on Event putting Virtual server name but nothing is coming
- spalande
It should come. Not sure, if GUI is not able to show the past days logs. In that case, check from the bash shell.
You can also take a look at https://support.f5.com/csp/article/K09050750
- spalande
To add more, BIGIP logs are retained upto last 8 days by default. If remote logging is configured, any logs before 8 days you might need to check on the remote syslog server.
- Ahmed_Galal
easy way to copy audit via scp to ur PC then search with VS name