Forum Discussion
Hem_66900
Oct 23, 2015Cirrus
It is format issue and SIEM not interpreting it fine.
Assume SIEM ip and port is x.x.x.x:514 Run the following tmsh commands. 1.Create pool 2.HSL log config 3.Syslog log config 4.Publisher.
create ltm pool pool.HSLogging.SIEM members add { x.x.x.x colon port} create sys log-config destination remote-high-speed-log SIEM_Server description SIEM_Server pool-name /Common/pool.HSLogging.SIEM protocol udp create sys log-config destination remote-syslog SIEM_Filter description SIEM_Filter format rfc5424 remote-high-speed-log SIEM_Server create sys log-config publisher Syslog_Publisher description Splunk_Publisher destinations add { SIEM_Filter }
Good luck !!!!