Remote Syslog for ASM

Hello Mate,

Create a logging profile in ASM event logging.

Follow below procedure:

1. Go to Security ›› Event Logs ›› Logging Profiles
2. Create a logging profile, select Application Security
3. Select Remote Storage in the configuration section
4. Select protocol UDP (if you are using Syslog) and Add Syslog server Ip address and port number (default port number is 514)
5. Storage format select appropriate or All
6. Select request type according to the requirement.
7. Finish.

That’s it. You will start getting the syslog for ASM module. It is not mandatory to have it enabled in the settings page. You can remove that remote logging configuration in the settings page , if you don’t need the ltm audit logs.

Sample log: Sep 17 09:40:07 Sep 17 09:40:11 hostname ASM:"Information Leakage","2015-09-17 09:40:10","10.x.x.x","80","N/A","/Perf_Test/test_vs","N/A",

Hope this helps.

-Jinshu

Hi All,

It's already solve. Your're right Boneyard, I still need to add a management route so my ASM will send their log into syslog server. Previously I think that the default interface that was used to send log into syslog server was management interface, but actually it was wrong.

The default interface is still the self-IP. It means that the first priority of routing table that was used for accessing the remote server is TMM routing table. Because I have a default route on my TMM, and this default route has no routing into the syslog server, so my ASM will not send the log into the syslog server. What I do then is adding one specific routing with destination to syslog server on the BIG-IP managemet routing table, and perfect, ASM start to send the log into the syslog server.

Thanks a lot everybody. Really appreciate it.

Ahmad :)