For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

THi_89722's avatar
THi_89722
Icon for Nimbostratus rankNimbostratus
Oct 14, 2015

Log message code list?

SOL16197: Reviewing BIG-IP log files describes local traffic log message format as:

Message code is split into:

Message code: The code that is associated with the message. The code is comprised of the following sub-codes:

  • Product Code: The first two hex digits form the product code. For example, 0x01 is the BIG-IP product code.
  • Subset Code: The third and fourth hex digits are the subset code. For example, 0x2a is the subset code for LIBHAL.
  • Message Number: The next four digits form the message number within a module.
  • Severity Level: The last digit between the colon symbols is the severity level, with 0 being the highest severity level.

Are the Product and Subset codes listed anywhere? Would help in processing log messages further in Splunk or similar tool.

application delivery
logging
LTM
management

5 Replies

  • seamlessfirework's avatar
    seamlessfirework
    Icon for Cirrostratus rankCirrostratus
    Feb 14, 2024

    I got an answer from the support. They opened an issue:

    (Bug alias 894213) DOC - Include APM log messages into Error Catalog (log-messages.html

    Beside that the support gave me the following workaround which is quite good imho:

    "For example, if you wish to get more info about mentioned codes we will see that the first log is generated for Access policy per-request logging agent and the second log is for APM oAuth agent:

    # cat /run/bigip_error_maps.dat | grep '01870023\|01490291'

    1 LOG_NOTICE 01870023 BIGIP_ACCESSPERREQUEST_ACCESS2_LOGGING_AGENT "%s:%s:%.*s: %.*s"

    1 LOG_NOTICE 01490291 BIGIP_ACCESSCONTROL_APDNOTICE_OAUTH_AGENT_SUCCESS "%s:%s:%s:%s: OAuth %s: succeeded for %s '%s'%s %s%s" "

    The content of the dat file seems to include all log message ids the BIG-IP can put into the log files. HTH

  • seamlessfirework's avatar
    seamlessfirework
    Icon for Cirrostratus rankCirrostratus
    Jan 11, 2024

    I know this thread is old, but I had the same question today. I raised a ticket to support.

  • THi's avatar
    THi
    Icon for Nimbostratus rankNimbostratus
    Mar 07, 2016
    Unfortunately no answer so far. Think we need to raise a ticket to support.
  • Arindam_Novell_'s avatar
    Arindam_Novell_
    Icon for Nimbostratus rankNimbostratus
    Mar 04, 2016
    I too have the same question for parsing in a SIEM solution. Is there any comprehensive list? Did you get any information on this? thanks Arindam