Log to a seperate log file

Hi Bjoern,

 

 

Which LTM version are you running? For 9.4.2 and later, take a look at this post (particularly the article in the last entry) (Click here). For versions lower than 9.4.2, check this Codeshare example (Click here) for configuration options for syslog-ng.

 

 

Aaron

Hi Bjoern,

 

 

First thing is you need to escape the double quotes within the

 

 

syslog include "

 

 

and

 

 

};"

 

 

lines.

 

 

 

http://devcentral.f5.com/Default.aspx?tabid=63&articleType=ArticleView&articleId=155

 

 

The double quotes before and after the syslog-ng.conf stanzas delimit the data that will be included in the configuration file. Any other double quotes (those embedded in the syslog-ng.conf stanzas themselves) must be escaped with a backslash '\,' as when defining destination IP addresses above.

 

 

 

 

Aaron

ramann,

 

 

try this and let us know.

 

 

syslog include "

 

destination d_logger0 {

 

file(\"/var/log/logger0\" create_dirs(yes));

 

};

 

log {

 

source(local);

 

destination(d_logger0);

 

};"

hi,

 

 

import was possible.

 

 

[root@weblb1:Active] config b syslog list

 

syslog {

 

include "

 

destination d_logger0 {

 

file(\"/var/log/logger0\" create_dirs(yes));

 

};

 

log {

 

source(local);

 

destination(d_logger0);

 

};"

 

}

 

 

 

When it try now to use it:

 

 

when RULE_INIT {

 

log local0. "BLABLA initialized"

 

}

 

when HTTP_REQUEST {

 

set debug 1

 

if { $debug equals "1" } {log logger0. "original:[HTTP::uri]"}

 

}

 

 

It get in my iRule Editor:

 

 

line 6: [Invalid syslog level - bad facility: logger0] [log logger0. "original:[HTTP::uri]"]

 

 

 

Thanks

 

Bjoern

You would need to log from the iRule to a valid syslog-ng facility (local0. - local7). What you'd normally do is configure a custom syslog-ng filter and destination so that if the log string from the iRule matches the filter, the log statement would be written to the destination.

Here is an example of logging any statement sent to local0.info containing a string "logging" to a remote syslog server. You could modify this to use a custom local file using the destination you've created in your last post.

http://devcentral.f5.com/wiki/default.aspx/iRules/LogHttpTcpUdpToSyslogng.html

 
     local0.info                                   send logging entries to remote syslog server 
    filter f_local0.info { 
       facility(local0) and level(info) and match("logging"); 
    }; 
  
  
     destination can be a hostname or IP address 
    destination d_logging { 
       tcp("syslog.myhost.com" port (5000)); 
    }; 
  
  
    log { 
       source(local); 
       filter(f_local0.info); 
       destination(d_logging); 
    }; 
 

Aaron

Now it works - Thanks!