Forum Discussion

Danny_Arroyo's avatar
Danny_Arroyo
Icon for Cirrus rankCirrus
Nov 01, 2018

How to Log Messages From The LTM Log to remote syslog server

We have an 2000 series F5 HA Cluster running v13.1.0.8 build 0.0.3. One of our Linux admins built a Graylog cluster so all our Admins can send their logs to the Graylog server cluster. The linux admin wants me to front end the graylog cluster on the F5. I was able to create a VS for the Graylog server Web Portal and also created a VS for UDP 5140 that will send log messages to port 5140 on the Graylog Cluster.

 

However I can't get the F5 /var/log/LTM messages to be sent to the Graylog Server Cluster through the F5 VS. I added the Graylog VS ip address to the F5 Remote Syslog Server list. I also configured the High speed Logging settings on the F5 with the Graylog VS ip address. However all I see in the Graylog Web Portal are monitoring messages from the F5.

 

Any ideas?

 

devops
LTM
security
  • Stanislas_Piro2's avatar
    Stanislas_Piro2
    Icon for Cumulonimbus rankCumulonimbus
    Nov 01, 2018

    Did you see this thread?

     

    You can configure request logging to send logs to graylog... Json format allow you to not manage parser on graylog.