Forum Discussion
NimbostratusQradar setup issue
We are setting up sending our F5 info to Qradar but local/ is being placed in front of the hostname of teh BIGIP.
We have gone thru the following steps
mount -o remount,rw /usr <------ makes /usr writable
then modified the following variable to null
(before) my $hostslot = "local/";
(after) my $hostslot = "";
Then when tailing the /var/log/ltm file we still see the /local infron t of the hostname
Jan 16 07:26:38 local/ltm4mgt alert mcpd[3511]: 01070921:1: Virtual Server 'H1PRD_KEY_DR' on partition 'Common' disabled by user 'shane'.
BUT we have found that after a reboot the local above will go away. Is there a way to get this change to take place without a reboot.
Thanks
4 Replies
hoolioCirrostratus
You could try a custom syslog include statement instead of modifying the templ file. It should be more supportable as the config will be included in the upgrade if you use ‘tmsh modify sys syslog include…’.\
https://devcentral.f5.com/community/group/asg/44/aft/1174103/showtab/groupforums
Aaron- nitass
Employee
e.g.by default [root@ve10:Active] config b syslog include SYSLOG - Include Data: none [root@ve10:Active] config b pool foo monitor all none [root@ve10:Active] config b pool foo monitor all tcp [root@ve10:Active] config cat /var/log/ltm Jan 18 06:20:44 local/ve10 notice mcpd[3776]: 01070638:5: Pool member 200.200.200.101:80 monitor status unchecked. Jan 18 06:20:51 local/ve10 notice mcpd[3776]: 01070727:5: Pool member 200.200.200.101:80 monitor status up. customization [root@ve10:Active] config b syslog include '" > local0.* /var/log/ltm > filter f_local0 { > facility(local0); > }; > filter f_no_audit { > not match(\"AUDIT\"); > }; > destination d_ltm { > }; > log { > source(s_syslog_pipe); > filter(f_local0); > filter(f_no_audit); > destination(d_ltm); > }; > > template t_customtmpl { > template(\"$DATE $HOST $PRIORITY $MSG\n\"); > template_escape(no); > }; > destination d_customltm { > file(\"/var/log/ltm\" create_dirs(yes) template(t_customtmpl)); > }; > log { > source(local); > filter(f_local0); > filter(f_no_audit); > destination(d_customltm); > }; > "' [root@ve10:Active] config b pool foo monitor all none [root@ve10:Active] config b pool foo monitor all tcp [root@ve10:Active] config cat /var/log/ltm Jan 18 06:22:30 ve10 notice mcpd[3776]: 01070638:5: Pool member 200.200.200.101:80 monitor status unchecked. Jan 18 06:22:35 ve10 notice mcpd[3776]: 01070727:5: Pool member 200.200.200.101:80 monitor status up. 
pulseTo the original post, I am also curious about this. Editing the syslog.tmpl and then rebooting works, but just restarting syslog-ng does not, even though that is what the QRadar/F5 instructions say. How can you get syslog to recognize this without rebooting?
RHendle_110546Any idea how to make the same change to display hostname in the syslog configuration for facilities using tmsh??
