Forum Discussion

AbuAhmad's avatar
AbuAhmad
Icon for Nimbostratus rankNimbostratus
Mar 26, 2014

Logging client IP address for SSH attempts

I have a request to log client IP address for SSH port 22 connections and attempts. The issue they have that they see numerous logins attempts with Root, guest, admin user IDs and wrong password, any...
application delivery
BIG-IP DNS
LTM
management
kunjan's avatar
kunjan
Icon for Nimbostratus rankNimbostratus
Mar 27, 2014

You can do as below

 

when CLIENT_ACCEPTED { log 192.168.xx.xx local0.info "Request for service at port [TCP::local_port] from [IP::client_addr]" }

 

The logs will be in text format. The file location will be defined in /etc/syslog.conf(assuming *nix system) in the remote syslog server

 

On the remote syslog server, you have to enable remote syslog for the syslog clients, in this case bigip IP address.

 

http://www.freebsd.org/doc/handbook/network-syslogd.html

 

You can test it using 'logger' cmd from bigip, before testing with iRule.

 

logger -h 192.168.xx.xx -p local0.info "Testing"