For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

mdiamore's avatar
mdiamore
Icon for Nimbostratus rankNimbostratus
May 06, 2020

Logging Facilities Missing in /sys syslog all-properties

Can some explain the limitations on the available logging facilities via the edit /sys syslog all-properties command?

 

This question stems from an issue I'm having with HSL/Splunk log offload configuration. In the past, configuration via the more basic "remote servers" component was able to offload items from /var/log/ltm such as TCP Resets (if configured via /sys db tcpreset.log value) and SSL Handshake failures.

However, since transitioning to include destination d_remote_loghost {target IP/ports} and a basic HTTP request iRule, I am unable to see any of these messages.

 

One would think that local0-5 (and local7) would be available for offload configuration but clearly a syntax error is returned.

 

What am I missing / interpreting wrong in the configuration instructions to both A) get more in-depth /var/log/ltm content, and B) have it successfully offload to Splunk?

No RepliesBe the first to reply