Mar 27, 2026 - For details about updated CVE-2025-53521 (BIG-IP APM vulnerability), refer to K000156741.

Forum Discussion

Oly_r's avatar
Oly_r
Icon for Altocumulus rankAltocumulus
2 years ago

MCP logging to remote server

I've been trying to set the MCP logging which we are required to have at debug level to a remote server. Is this possible? When i set up the remote logging for the virtual servers i had to go into each of them and point to the publisher, i don't see anyway to do that for default type logs (audit, secure, messages etc.)

any help would be greatly appreciated.

Rick.

2 Replies

  • Oly_r's avatar
    Oly_r
    Icon for Altocumulus rankAltocumulus

    I've tried the K56602501 instructions but get nothing, i've got to be missing something.

    1.     modify syslog {
              auth-priv-from notice
              auth-priv-to emerg
              cron-from warning
              cron-to emerg
              daemon-from notice
              daemon-to emerg
              description none
              include none
              iso-date disabled
              kern-from notice
              kern-to emerg
              mail-from notice
              mail-to emerg
              messages-from notice
              messages-to warning
              remote-servers none
              user-log-from notice
              user-log-to emerg
          }

       
    2.  Replace the include none line with the desired syslog filter. For example, to configure syslog-ng to log warning through emergency log level messages to UDP port 514 on destination hosts 192.168.1.1 and 192.168.1.2, use the following syntax:

          include "
              filter f_audit{
                  match(AUDIT);
              };
              destination d_syslog_server {
                      udp(\"192.168.1.1\" port (514));
                      udp(\"192.168.1.2\" port (514));
              };
              log {
                      source(s_syslog_pipe);
                          filter(f_audit);
                          destination(d_syslog_server);
              };
              "
  • Hey Oly_r - I see that nobody has replied yet, so I'm featuring your post in this week's Community Highlights article in order to boost visibility for you.