Forum Discussion

SANTS_boy_18328's avatar
SANTS_boy_18328
Icon for Nimbostratus rankNimbostratus
Mar 03, 2015

Send only Audit logs to remote syslog

Hi,   we have a qradar server where we will send the F5 logs to it. We only want the Audit logs to be sent to qRadar.   How can I filter what type of logs I sent to the remote syslog server (qr...
application delivery
deployment
LTM
SANTS_boy_18328's avatar
SANTS_boy_18328
Icon for Nimbostratus rankNimbostratus

Thanks Jason, but when you press remote syslog, you are forced to put the High Speed Syslog afterwards.

 

How can I over pass this?

 

thanks.

 

SANTS

 

JRahm's avatar
JRahm
Icon for Admin rankAdmin
Mar 03, 2015
Right..but that just means you are using HSL under the hood of BIG-IP, if you select syslog formatting, it won't just be the RAW format typical of HSL. All that's required for that is to define a pool (can be one member->your syslog server) and then select it as your destination