Forum Discussion
split ltm log per partition
Well, with the native behavior, I think its not actually present. Because you get all the ltm event logs of every partition in the same /var/log/ltm log file.
If your intention is to view logs of particular partition, why not just split or filter using commands or use HSL logging to view in a custom way.
Also you have remote syslog configuration, where you can apply filters and send it to the remote syslog servers, so only of a particular partition log is seen, yes you have to apply filters to achieve it. Refer - K13333: Filtering log messages sent to remote syslog servers (11.x - 13.x)
If you really want the logs of a partition in a separate log file, then you might need to modify the syslog-ng.conf file. K7342: Overview of the syslog-ng.conf file
In article K7342 see section,
For example:
local0.* /var/log/ltm
filter f_local0 {
facility(local0);
};
destination d_ltm {
file("/var/log/ltm" create_dirs(yes));
};
log {
source(s_syslog_pipe);
filter(f_local0);
destination(d_ltm);
};
So in your case, you would need a filter, destination & log blocks created for your partition. So it should be something like below,
custom partition log /var/log/partitionname/ltm
filter f_partitionname {
level(notice..warning) and match("/partitionname/");
};
destination d_partitionname {
file("/var/log/partitionname/ltm" create_dirs(yes));
};
log {
source(s_syslog_pipe);
filter(f_local0);
filter(f_no_audit);
filter(f_partitionname );
destination(d_partitionname);
};
Haven't tested it personally, referred the syslog-ng.conf file and built the blocks. You can modify according to your need and see the results. Try testing in your lab box. Take a backup of original syslog-ng.conf file too and restart service after you making your changes as well.
Recent Discussions
Related Content
* Getting Started on DevCentral
* Community Guidelines
* Community Terms of Use / EULA
* Community Ranking Explained
* Community Resources
* Contact the DevCentral Team
* Update MFA on account.f5.com