Forum Discussion
Only those taken in the / var / log / apm can I send to syslog?
Hello,
I can now use the Big-IP 11.5.3, and operate the APM.
As customer's request, only logs taken in / var / log / apm want to send to syslog.
I was now haedu specify the IP address and Port to log >> configuration >> remote logging,
pool also add is registered with VS.
And I made an iRule,
when CLIENT_ACCEPTED { set ClientIP [IP::client_addr] }
when ACCESS_POLICY_AGENT_EVENT { switch [ACCESS::policy agent_id] { "IP_Assign" { set hsl [HSL::open -proto UDP -pool syslog_pool1] set id [ACCESS::session data get session.logon.last.username] set Assign [ACCESS::session data get session.custom.id] log local0. "F5 Network clientIP= '$ClientIP' User= '$id' Assign_IP = '$Assign' Assign ACL Assign Split" HSL::send $hsl "F5 Network clientIP= '$ClientIP' User= '$id' Assign_IP = '$Assign' Assign ACL Assign Split" } } }
But there is a problem.
Continuously stamped with a health check and logs are similar,
The logs are taken to the menu, such as when you move various BIG-IP UI.
How can I do this?
I wish only the APM log jjikhyeot.
For example, like shown in the Access Policy >> Reports.
- Walter_KacynskiCirrostratus
If you want ONLY the APM logs at a remote logging server, then you would need to configure a Log Filter for the "access" category of message to be sent over the HSL pool. This configuration would require no iRules on your part.
Please see this article: https://support.f5.com/kb/en-us/products/big-ip_ltm/manuals/product/bigip-external-monitoring-implementations-11-3-0/2.html
Recent Discussions
Related Content
* Getting Started on DevCentral
* Community Guidelines
* Community Terms of Use / EULA
* Community Ranking Explained
* Community Resources
* Contact the DevCentral Team
* Update MFA on account.f5.com