For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

afreudenr's avatar
afreudenr
Icon for Nimbostratus rankNimbostratus
Aug 02, 2019

Some audit logs do not show on remote syslog server

I have set up a syslog HSL filter/destination which sends ALL syslogs including audit logs to a logstash server. The data is showing there, but it seems that no all of the audit log data is sent.

More specifically all pam_ldap and ldap user login information is missing (httpd/sshd login)

 

Is there a way to configure this in the GUI, or are there changes on the command line needed (or did I misconfigure?)? If yes, any details?

 

Thanks,

Andreas

2 Replies

  • JG's avatar
    JG
    Icon for Cumulonimbus rankCumulonimbus
    Aug 05, 2019

    That information should be logged in /var/log/secure .

  • afreudenr's avatar
    afreudenr
    Icon for Nimbostratus rankNimbostratus
    Sep 03, 2019

    Thanks JG, but I need to know if there is a way to include this information in remote logging through the F5 GUI (or tmsh). I know I can get it on the Linux level, but would like to avoid that if possible.