For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

yuanqiang_22112's avatar
yuanqiang_22112
Icon for Nimbostratus rankNimbostratus
Jun 19, 2016

nat log to syslog server

Hello I creae a virtual server ,enable sant automap,I can reach to server with self ip ; I check nat log in F5 command ,but there is nothing . I don't know why ; I want to send NAT LOG to syslog server , his requirement can be achieved ?

 

application delivery
LTM
TMSH

1 Reply

  • IanB's avatar
    IanB
    Icon for Employee rankEmployee
    Jun 20, 2016

    The snat/nat function does not log anything, as this could produce a huge amount of data, however you capture and send this information by adding a simple irule to any virtual servers that you need to produce logs for.

    You could use standard logging, and then set up logging (syslog-ng) to relay to a remote server, or you could use High Speed Logging (HSL) to send syslog messages directly from tmm to the receiving server:

    You then just need to send a message containing whatever information you require, such as IP::local_addr, IP::remote_addr, TCP::local_port, TCP::remote_port.

    For example:

    when LB_SELECTED {
    log local0. "[IP::client_addr]:[TCP::client_port] -> [IP::local_addr]:[TCP::local_port]; [HTTP::host][HTTP::uri]"
}

    Another way you could do it would be to use a request logging profile:

    https://devcentral.f5.com/questions/configuring-a-request-logging-profile

    Does that help ?