LTM logs(All events) to splunk using HSL

Can you post more detail on your publisher and filter configurations please?

HSL configuration: Publisher:

name Splunk -hsl partition: Common Destination : Splunk-formatted

Filters:

Name: Filter-splunk partition: Commom severity: informational source :all Message Id : Log publisher: Splunk-hsl

Publisher:

 name Splunk -hsl
  partition: Common
   Destination : Splunk-formatted

Filters:

  Name: Filter-splunk
 partition: Commom
  severity: informational
   source :all
    Message Id :
     Log publisher: Splunk-hsl

Do you guys have any update on this one.Any insight on this one is greatly appreciated.

Any update on this one?Im facing similar issue as well.

I have configured hsl and are forwarding logs to mcafee siem. I am also receiving similar errdefs_msgno="01260018:5: logs.

Any idea as why only those logs.

It is format issue and SIEM not interpreting it fine.

Assume SIEM ip and port is x.x.x.x:514 Run the following tmsh commands. 1.Create pool 2.HSL log config 3.Syslog log config 4.Publisher.

create ltm pool pool.HSLogging.SIEM members add { x.x.x.x colon port} create sys log-config destination remote-high-speed-log SIEM_Server description SIEM_Server pool-name /Common/pool.HSLogging.SIEM protocol udp create sys log-config destination remote-syslog SIEM_Filter description SIEM_Filter format rfc5424 remote-high-speed-log SIEM_Server create sys log-config publisher Syslog_Publisher description Splunk_Publisher destinations add { SIEM_Filter }

Good luck !!!!

the HSl configuration that i did is partially working. I have created a request logging profile and have modified the template in http request to fit the SIEM parser format and sequence and that works like a sweet candy using the tmm interface i configured and mapped the the new vlan.

Now the problem is the i am not getting the system logs via HSL. i cannot see any audit log. Incase i add the siem server as remote syslog server then i start receiving but i loose control as i cannot use my log filter because it is not using the hsl.

had raised a f5 case. there is something which is still not triggering the system logs through hsl tmm interface.