LTM logs to external syslog (Splunk)

You're looking for connection logging. There's a couple of very good articles out there about using High Speed Logging.

Here's a couple of other dev central resources for you.

https://devcentral.f5.com/wiki/irules.HSL.ashx https://devcentral.f5.com/questions/logging-client-connections-to-syslog

1- Each client IP and going to which pool member (which server was selected)

- High Speed Logging. See the links above.

2- No of transactions per Virtual Server

- can be extrapolated from the connection logging information. Usually done on a reporting server. However, you can get this information directly from the box by looking at Virtual Server Statistics. 

3- Pool member health status

- This is found in /var/log/ltm. If you configure syslog like Shaggy mentioned, you're all set.

4- Virtual Server health status

- See "3" from above.

Thanks a lot. So If I configure syslog under under system -> logging then /var/log/ltm by default will go to syslog server?

I want to send only LTM and Audit Logs (admin activities) to remote syslog server. How I can filter the syslog setting.

can you try something like this? it filters ltm (local0) and audit logs.

sol13333: Filtering log messages sent to remote syslog servers (11.x)

root@(ve11a)(cfg-sync In Sync)(Active)(/Common)(tmos) list sys syslog include
sys syslog {
    include "
destination d_remote_loghost {
  udp(\"172.28.24.1\" port(514));
};
log {
  source(s_syslog_pipe);
  filter(f_local0);
  filter(f_no_audit);
  filter(f_no_msgbusd);
  filter(f_no_icrd);
  filter(f_no_urlfilter);
  filter(f_no_ipsec);
  destination(d_remote_loghost);
};
log {
  source(s_syslog_pipe);
  filter(f_audit);
  destination(d_remote_loghost);
};
"
}

I want to send only LTM and Audit Logs (admin activities) to remote syslog server. How I can filter the syslog setting.

can you try something like this? it filters ltm (local0) and audit logs.

sol13333: Filtering log messages sent to remote syslog servers (11.x)

root@(ve11a)(cfg-sync In Sync)(Active)(/Common)(tmos) list sys syslog include
sys syslog {
    include "
destination d_remote_loghost {
  udp(\"172.28.24.1\" port(514));
};
log {
  source(s_syslog_pipe);
  filter(f_local0);
  filter(f_no_audit);
  filter(f_no_msgbusd);
  filter(f_no_icrd);
  filter(f_no_urlfilter);
  filter(f_no_ipsec);
  destination(d_remote_loghost);
};
log {
  source(s_syslog_pipe);
  filter(f_audit);
  destination(d_remote_loghost);
};
"
}

which version are you using, the log filter might also be able to do something for you, instead of playing with the syslog-ng config.

https://support.f5.com/kb/en-us/products/big-ip_ltm/manuals/product/tmos-concepts-11-3-0/tmos_logging.html

Just configure (/Common)(tmos.sys) edit /sys syslog all-properties

Go to the line that says "include none" and replace that line with:

include "
destination remote_server {
    udp(\"IP-OF-SYSLOG-SERVER\" port (514));
};
filter f_ltm {
    facility(local0) and level(emerg..info); }; log {
    source(local);
    filter(f_ltm);
    destination(remote_server);
};
"