Forum Discussion

RyanDM2_175490's avatar
RyanDM2_175490
Icon for Nimbostratus rankNimbostratus
Feb 12, 2015

Send Access Policy traffic to Syslog

I have configured my VE APM to send HSL syslog to a remote SIEM server. However, other than admin access to the F5 itself, there doesn't seem to be any of the Access policy logging that is sent to th...
BIG-IP Access Policy Manager (APM)
deployment
security
RyanDM2_175490's avatar
RyanDM2_175490
Icon for Nimbostratus rankNimbostratus
Feb 16, 2015

Thanks for the reply... I have tried the iRule method, based on other examples I've seen on devcentral, but I can't say that I really know what I'm doing.

 

The other method...do you have a kb link for how to do that?

 

Thanks,

 

RyanDM2_175490's avatar
RyanDM2_175490
Icon for Nimbostratus rankNimbostratus
Feb 16, 2015
In fact, in following this: https://support.f5.com/kb/en-us/solutions/public/5000/500/sol5527.html What I get using my test account is the following from a tcpdump of syslog messages: "Syslog message: LOCAL7.INFO..etc...LOGOF:success r.m.ilt9:ssid ....etc" where it shows only the logof value.