Forum Discussion

richarc's avatar
richarc
Icon for Nimbostratus rankNimbostratus
Jun 05, 2023

Remote Logging still going to /var/log/ltm

I used the log IP for an irule and the log lines are still going to /var/log/ltm.  I only want the output to skip /var/log/ltm/ and only output to the syslogs. Is that possible? Thanks   irule bein...
devops
whisperer's avatar
whisperer
Icon for MVP rankMVP
Jun 05, 2023

Here is the kb article: https://my.f5.com/manage/s/article/K13317.

The default facility used when using the 'log' statement in an irule is local0, or /var/log/ltm. So, maybe use facility 'info' which in theory should not be logged, depending on how your syslog is configured within the settings page.

So...

when HTTP_RESPONSE {
log local0.info XX.XX.XXXXX:514 [HTTP::response]
}

Alternatively, you can try also logging directly to the syslog IP hard coded in the iRule: https://clouddocs.f5.com/api/irules/log.html. So...

So...

when HTTP_RESPONSE {
log 192.168.1.1 local0.info XX.XX.XXXXX:514 [HTTP::response]
}

Where 192.168.1.1 is your SYSLOG server.

So a few more thoughts to maybe help you out.