Forum Discussion

CEnroth's avatar
CEnroth
Icon for Nimbostratus rankNimbostratus
Oct 28, 2023

LTM Policy don't send to external log server

Hi Can someone explain to me, what im doing wrong. I have a policy attached to a Virtual-Server, and it is triggered when a specific URI enters. There are two actions, one that logs a message to l...
devops
  • Paulius's avatar
    Paulius
    Oct 28, 2023

    CEnroth This might be one of those instances where you try the iRule equivalent and see if it has the same results. If you do have the same result you might have to reach out to F5 TAC to see if it's an unkown bug or possibly a missconfiguration.

CEnroth's avatar
CEnroth
Icon for Nimbostratus rankNimbostratus

PauliusThanks for the information.
In this case I use "Route Domains" for all other communications, so "list net route one-line" is empty.
Mgmt interface had a "default route", but to be sure that nothing had better route then that I added a /32.

Once in a while I get below error message, and initially i thought it was remote syslog server that "rejected" the packages but as I said in before I used TCPDUMP to see if anything exited the Mgmt interface but nothing did.

Error in log file:
Execution of action 'log write port=514 message= facility=local0 priority=info ip-address=192.168.0.100' failed, error ERR_REJECT

It is possible that packages leaves the loadbalancer on some other interface, but I had TCPDUMP listen on all other interface and did not see udp/514 packages on any of them.

And forgot to say that i can  PING syslog server from LB, and that package leaves on Mgmt interface.

/C

Paulius's avatar
Paulius
Icon for MVP rankMVP
Oct 28, 2023

CEnroth This might be one of those instances where you try the iRule equivalent and see if it has the same results. If you do have the same result you might have to reach out to F5 TAC to see if it's an unkown bug or possibly a missconfiguration.

  • CEnroth's avatar
    CEnroth
    Icon for Nimbostratus rankNimbostratus
    Oct 28, 2023

    PauliusThanks for all input, and i think you are right about routing. And as I use "route domains" then /Common (id = 0) would probably be the one where all messages would be sourced from. But in my case I don't use /Common and there for this route domain has no routes. One can think that the ERR_REJECT message indicates that there is no way out from this vlan/net. But I will do as your suggestion and try a iRule with HSL::send to see if that works.

    And once again, thanks for the input 😀

    Regards
    Christian