For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

jacfal's avatar
jacfal
Icon for Nimbostratus rankNimbostratus
Jul 21, 2021

Reporting DoS events through syslog not work

Hi, I am trying to send syslog formatted DoS events to a remote server. I proceeded as follows:

 

  1. I created syslog pool, which contains one member listening on x.x.x.x:6514. The pool is completely accessible, UDP monitoring is green
  2. I created HSL log destination with pool from step 1.; protocol - UDP; Distribution - adaptive. Then I created another log destination with syslog format and with forwarding to the created HSL log destination
  3. Next, I created a log publisher, which contains only "syslog log destination"
  4. At the last, in Security Event logs I created a new logging profile where I enabled "DoS protection" and set remote publisher to publisher created in the 3. step

 

When I generate some test DoS attack (via hping), I see this attack at the DoS real-time dashboard, but none event is sent to the remote syslog server (verified by tcpdump). What confuses me is that I don't see any DoS events in DoS event logs neither. Am I missing something? 

 

BigIp version: 15.1.2.1

No RepliesBe the first to reply