For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Shiva_69966's avatar
Shiva_69966
Icon for Nimbostratus rankNimbostratus
Nov 18, 2014

LTM logs(All events) to splunk using HSL

Hi Guys need help in settingup HSl for Bigip logs. as F5 recommend i have followed the porcedure creating pool(log servers)->log destination-> publisher- filter.   Now the challenge we face is we ...
application delivery
deployment
design
LTM
performance
Hem_66900's avatar
Hem_66900
Icon for Cirrus rankCirrus
Oct 23, 2015

It is format issue and SIEM not interpreting it fine.

 

Assume SIEM ip and port is x.x.x.x:514 Run the following tmsh commands. 1.Create pool 2.HSL log config 3.Syslog log config 4.Publisher.

 

create ltm pool pool.HSLogging.SIEM members add { x.x.x.x colon port} create sys log-config destination remote-high-speed-log SIEM_Server description SIEM_Server pool-name /Common/pool.HSLogging.SIEM protocol udp create sys log-config destination remote-syslog SIEM_Filter description SIEM_Filter format rfc5424 remote-high-speed-log SIEM_Server create sys log-config publisher Syslog_Publisher description Splunk_Publisher destinations add { SIEM_Filter }

 

Good luck !!!!