Forum Discussion
cbdick
Nimbostratus
NimbostratusRemote syslog not working with certain IP
Hi there,
We have a GTM BIG-IP 9.4.8 Build 355.0 Final. I have setup syslog to send logs to two remote servers as per the http://devcentral.f5.com/Tutorials/...ation.aspx topic. The appropriate entries are added to /etc/syslog-ng/syslog-ng.conf, however, some of the IP addresses do not seem to work. For example, this works:
destination remote_server { udp("10.1.3.101" port (514)); udp("10.1.3.102" port (514)); }; log { source(local); destination(remote_server); }; But this doesn't: destination remote_server { udp("10.1.3.101" port (514)); udp("10.0.3.101" port (514)); }; log { source(local); destination(remote_server); }; In the first example the syslogs are seen in a tcpdump outbound to both IP of the remote servers. In the second example, I am only seeing 10.1.3.101 in tcpdump? I posed a question to the syslog-ng folks but they did not think there were any limitations on IP addresses used. Has anyone else encountered this with their f5? Any ideas on why some IP work and others don't? Thanks in advance.
- Chris_Miller
Altostratus
On what subnet does your management IP reside? If it resides in the 10.0.3.0/24 subnet, it might be sending outbound but you'd need to be capturing on eth0:mgmt to see it. 
cbdickThanks Chris,
It did turn out that I had an interface addressed in the 10.0.3.0/24 range. Once I monitored the proper interface with tcpdump, traffic showed up. Thanks for pointing out the obvious.
