Forum Discussion
split ltm log per partition
Is it possible to split ltm log file (var/log/ltm) per partition?
Well, with the native behavior, I think its not actually present. Because you get all the ltm event logs of every partition in the same /var/log/ltm log file.
If your intention is to view logs of particular partition, why not just split or filter using commands or use HSL logging to view in a custom way.
Also you have remote syslog configuration, where you can apply filters and send it to the remote syslog servers, so only of a particular partition log is seen, yes you have to apply filters to achieve it. Refer - K13333: Filtering log messages sent to remote syslog servers (11.x - 13.x)
If you really want the logs of a partition in a separate log file, then you might need to modify the syslog-ng.conf file. K7342: Overview of the syslog-ng.conf file
In article K7342 see section,
For example: local0.* /var/log/ltm filter f_local0 { facility(local0); }; destination d_ltm { file("/var/log/ltm" create_dirs(yes)); }; log { source(s_syslog_pipe); filter(f_local0); destination(d_ltm); };
So in your case, you would need a filter, destination & log blocks created for your partition. So it should be something like below,
custom partition log /var/log/partitionname/ltm filter f_partitionname { level(notice..warning) and match("/partitionname/"); }; destination d_partitionname { file("/var/log/partitionname/ltm" create_dirs(yes)); }; log { source(s_syslog_pipe); filter(f_local0); filter(f_no_audit); filter(f_partitionname ); destination(d_partitionname); };
Haven't tested it personally, referred the syslog-ng.conf file and built the blocks. You can modify according to your need and see the results. Try testing in your lab box. Take a backup of original syslog-ng.conf file too and restart service after you making your changes as well.
Recent Discussions
Related Content
* Getting Started on DevCentral
* Community Guidelines
* Community Terms of Use / EULA
* Community Ranking Explained
* Community Resources
* Contact the DevCentral Team
* Update MFA on account.f5.com