Forum Discussion

afreudenr's avatar
afreudenr
Icon for Nimbostratus rankNimbostratus
Aug 02, 2019

Some audit logs do not show on remote syslog server

I have set up a syslog HSL filter/destination which sends ALL syslogs including audit logs to a logstash server. The data is showing there, but it seems that no all of the audit log data is sent.

More specifically all pam_ldap and ldap user login information is missing (httpd/sshd login)

 

Is there a way to configure this in the GUI, or are there changes on the command line needed (or did I misconfigure?)? If yes, any details?

 

Thanks,

Andreas

  • JG's avatar
    JG
    Icon for Cumulonimbus rankCumulonimbus
    Aug 05, 2019

    That information should be logged in /var/log/secure .

  • afreudenr's avatar
    afreudenr
    Icon for Nimbostratus rankNimbostratus
    Sep 03, 2019

    Thanks JG, but I need to know if there is a way to include this information in remote logging through the F5 GUI (or tmsh). I know I can get it on the Linux level, but would like to avoid that if possible.