For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

SANTS_boy_18328's avatar
SANTS_boy_18328
Icon for Nimbostratus rankNimbostratus
Mar 03, 2015

Send only Audit logs to remote syslog

Hi,   we have a qradar server where we will send the F5 logs to it. We only want the Audit logs to be sent to qRadar.   How can I filter what type of logs I sent to the remote syslog server (qr...
application delivery
deployment
LTM
JRahm's avatar
JRahm
Icon for Admin rankAdmin
Mar 03, 2015

Hi SANTS, in 11.6 (and earlier, though I don't know specifically which version it was introduced) you can create log filters, destinations, and publishers right in the GUI.

 

1st step: system->logs->configuration->log destination 2nd step: system->logs->configuration->log publisher 3rd step: system->logs->configuration->log filters

 

If on earlier systems, you can configure in tmsh/syslogd as well (good info in this article)