Forum Discussion

SonyF_86804's avatar
SonyF_86804
Icon for Nimbostratus rankNimbostratus
Jan 24, 2018

LTM-VE logging impact

I have a question regarding the LTM-VE sitting in AWS. We are using this LTM as a load balancer for web requests. A concern that was brought up from security was that our splunk logs on the private side do not have external IP addresses. I found a link that will allow me to write that information in the Irules of the LTM. https://devcentral.f5.com/wiki/iRules.LogHttpTcpUdpToSyslogng.ashx So my concern is that adding the extra rules to push the external IP information to a syslog server will add a lot of burden on that set of servers. I'm not quite sure of the impact. When I look at cloudwatch, I only see the CPU at 12% on avg. The server is an M4xlarge, so pretty big. I have been told that we have a number of Irules, so I'm not sure if there is best practice around adding logging rules like this, and where it should be in the order. Any help on this would be appreciated.... Or is there a better way to gather this information, rather than in Irules?

 

AWS
cloud
LTM
  • Simon_Blakely's avatar
    Simon_Blakely
    Icon for Employee rankEmployee
    Jan 25, 2018

    If the irules are logging data directly to a High Speed Logging pool, the impact should be pretty low.

     

    You can look at the CPU stats for irules/virtuals to determine the impact.

     

    There is no rule of thumb before implementation, though, so you just need to test it out (preferably on a test environment, naturally).