LTM Local Logging Question

Hi,

 

 

If you can log the messages to an external syslog server, you can use the log command to send the messages directly from an iRule:

 

 

http://devcentral.f5.com/wiki/default.aspx/iRules/log

 

log [-noname] [:] .[]

 

 

If a remote server isn't an option, it would be cleaner to configure syslog-ng to send specific messages to a separate file than take a default syslog facility and use it for your logging. The concept for configuring syslog is relatively simple. You'd want to create a new filter which states which syslog facility to check and which messages to match or not match on, a new destination which states where to send the messages and a new log statement which implements the first two configuration objects.

 

 

There are some examples in this Codeshare for the pre-9.4.2 configuration:

 

 

http://devcentral.f5.com/wiki/default.aspx/iRules/LogHttpTcpUdpToSyslogng

 

 

You would then need to modify the existing log filter to not match the specific messages if you don't want those messages logged to the default file.

 

 

So that's the end goal for the syslog-ng configuration. Then you need to use the b syslog command to add this configuration to the bigip_sys.conf file. Deb wrote a helpful article on this:

 

 

LTM 9.4.2+: Custom Syslog Configuration

 

http://devcentral.f5.com/Default.aspx?tabid=63&articleType=ArticleView&articleId=155

 

 

And here are a few related posts:

 

 

How to filter syslog messages

 

http://devcentral.f5.com/Default.aspx?tabid=53&forumid=31&tpage=1&view=topic&postid=62132

 

 

syslog-ng filter not working

 

http://devcentral.f5.com/Default.aspx?tabid=53&forumid=5&tpage=1&view=topic&postid=56442

 

 

Aaron