Forum Discussion

mike_rootvik_15's avatar
Icon for Nimbostratus rankNimbostratus
May 06, 2014

Security Event logs - local locations

This seems like a really stupid question to have to ask, but I can't seem to find an answer in the documentation.


I am running Big-IP 11.5 with AFM provisioned. I am running a Security Network Firewall rule (global) with logging enabled.


For various reasons I want to look at the local log file on the Big-IP from the command line, but can not locate them.


Where are the Network Firewall logs located? If the different contexts have logs in different locations, I'd appreciate knowing where the firewall logs are for Global, Virtual Servers and Self-IP.




10 Replies

  • It seems you have to specifically configure logging, no doubt because the logs could be considerable. See here for full details:


    It seems logging can only be applied per virtual server.


  • Thanks for the response. As indicated in the original post, I do have logging enabled (it is using the local-db-publisher) and configured to log Network Firewall events. Which I can sucessfully view via the GUI.


    What I am having issues with, is locating where these log entries are stored on Big-IP system, and how I can view them from the CLI.


    • What_Lies_Bene1's avatar
      Icon for Cirrostratus rankCirrostratus
      Ahhh, I see, sorry. I see if I can find out, will probably be tomorrow.
  • So, I've had a bit of a play. I think you'll find local syslog entries here: /shared/avr_afm.


    However, unless you configure the local-db-publisher to also use the local syslog facility I doubt you'll see anything. You can configure this under System > Logs > Configuration > Log Publishers.


    Let me know if this helps.


  • After crawling around the Big-IP for a while I discovered that the AFM rule loggin is written into the LTM log in /var/log/.


    At least when loggin was configured to use the local-db-publisher.


  • Hi mike,


    In wich file on /var/log/ AFM is logging ?


    Thank you,


    Best regards


    • What_Lies_Bene1's avatar
      Icon for Cirrostratus rankCirrostratus
      See above. In particular note that you need to enable syslog logging otherwise log entries are written to a database that can only be view via the GUI.
  • Sorry I posted my question too quickly,


    It's located on /var/log/ltm


    Thk you