For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

AbuAhmad's avatar
AbuAhmad
Icon for Nimbostratus rankNimbostratus
Mar 26, 2014

Logging client IP address for SSH attempts

I have a request to log client IP address for SSH port 22 connections and attempts. The issue they have that they see numerous logins attempts with Root, guest, admin user IDs and wrong password, any...
application delivery
BIG-IP DNS
LTM
management
Kevin_Stewart's avatar
Kevin_Stewart
Icon for Employee rankEmployee
Mar 27, 2014

If I may add, Kunjan is absolutely correct. The log statement in iRules sends traffic to a Syslog server. Without an IP address specified, it sends the message to the local Syslog server. You need a remote server that is running a Syslog instance and is configured to capture messages for the facilities that you're sending (ie. local0.info). Setting up a Syslog server isn't overly difficult, but can be different depending on your environment.

 

I would also add that HSL is a WAY better option here. Using the Log command will work, but 1) there's generally a limit to how many of those you can send out, and 2) the syslog traffic must pass through the management plane of the BIG-IP, which can induce some CPU spikes. HSL (high speed logging) is processed completely within the data plane and doesn't have the same limitations.