Forum Discussion

JayP_46820's avatar
JayP_46820
Icon for Nimbostratus rankNimbostratus
Jul 30, 2013

Logging AFM rules

Hi,   I am trying to setup logging of firewall rules and encountering problems. The F5 is running v11.3.     The setup I'd like is to have F5 log to remote Splunk server using three diffe...
management
monitoring
Richard_Tocci_7's avatar
Richard_Tocci_7
Historic F5 Account
Jun 25, 2015

This is an older thread but I found the solution:

 

SOL15368: The BIG-IP AFM system logs network firewall events using the logging profile associated with the network firewall rule

 

The "global-network" logging profile is used by the Global, Route Domain, SelfIP, and Management Port contexts. You must enable logging (either locally or remotely - it's highly recommended you do remote) and enable logging of specific events (Accept, Drop, etc).

 

This worked for me sending to a simple syslog server. Play with the format to get specific information you want.