For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

aj11's avatar
aj11
Icon for Nimbostratus rankNimbostratus
Jun 28, 2019

Logs of traffic to /tophat/tophat.js for the past week?

I was tasked with finding out information about traffic to a few hosts we have that hit a Virtual IP on the BIG-IP F5. They're trying to figure out who's still using the original Tophat and hasn't switched over to tophat2. I'm not entirely sure of where to start on this. Is there a way to capture this information from the last 7 days from Analytics in BIG-IP or other logs?

1 Reply

  • Unless you have an existing Analytics profile applied to the virtual server, the answer is no.

     

    The LTM (by default) does not log information on traffic passing through a virtual server.

     

    You can collect data with an Analytics profile (if AVR is provisioned), or apply a Request Logging profile - preferably to an off-box logging solution (like Splunk/ArcSight).

    Otherwise, you need to write an iRule to do this logging.

     

    Can this data be extracted from the pool member logs using X-Forwarded-For headers to identify incoming IP addresses?