For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Shiva_69966's avatar
Shiva_69966
Icon for Nimbostratus rankNimbostratus
Nov 18, 2014

LTM logs(All events) to splunk using HSL

Hi Guys need help in settingup HSl for Bigip logs. as F5 recommend i have followed the porcedure creating pool(log servers)->log destination-> publisher- filter.   Now the challenge we face is we ...
application delivery
deployment
design
LTM
performance
SDnath_82757's avatar
SDnath_82757
Icon for Nimbostratus rankNimbostratus
Oct 23, 2015

the HSl configuration that i did is partially working. I have created a request logging profile and have modified the template in http request to fit the SIEM parser format and sequence and that works like a sweet candy using the tmm interface i configured and mapped the the new vlan.

 

Now the problem is the i am not getting the system logs via HSL. i cannot see any audit log. Incase i add the siem server as remote syslog server then i start receiving but i loose control as i cannot use my log filter because it is not using the hsl.

 

had raised a f5 case. there is something which is still not triggering the system logs through hsl tmm interface.