Forum Discussion

  • Well, with the native behavior, I think its not actually present. Because you get all the ltm event logs of every partition in the same /var/log/ltm log file.

    If your intention is to view logs of particular partition, why not just split or filter using commands or use HSL logging to view in a custom way.

    Also you have remote syslog configuration, where you can apply filters and send it to the remote syslog servers, so only of a particular partition log is seen, yes you have to apply filters to achieve it. Refer - K13333: Filtering log messages sent to remote syslog servers (11.x - 13.x)

    If you really want the logs of a partition in a separate log file, then you might need to modify the syslog-ng.conf file. K7342: Overview of the syslog-ng.conf file

    In article K7342 see section,

    For example:
    
     local0.*    /var/log/ltm
    filter f_local0 {
       facility(local0);
    };
    destination d_ltm {
       file("/var/log/ltm" create_dirs(yes));
    };
    log {
       source(s_syslog_pipe);
       filter(f_local0);
       destination(d_ltm);
    };
    

    So in your case, you would need a filter, destination & log blocks created for your partition. So it should be something like below,

     custom partition log                            /var/log/partitionname/ltm
    
    filter f_partitionname {
       level(notice..warning) and match("/partitionname/");
    };
    
    destination d_partitionname {
       file("/var/log/partitionname/ltm" create_dirs(yes));
    };
    
    log {
       source(s_syslog_pipe);
       filter(f_local0);
       filter(f_no_audit);
       filter(f_partitionname );
       destination(d_partitionname);
    };
    

    Haven't tested it personally, referred the syslog-ng.conf file and built the blocks. You can modify according to your need and see the results. Try testing in your lab box. Take a backup of original syslog-ng.conf file too and restart service after you making your changes as well.