Syslog & Source IP on cluster

The support give me an other solution, otherwise to perform the upgrade : it is to modify the behaviour of the configuration file of the F5.

 

A little procedure here, this could maybe help !

 

 

1. Mount the usr partition in rw

 

 

mount -o remount,ro /usr

 

 

2. Backup and modify the config_base.conf file

 

Basically, this file determines all attributes of all objects of the configuration, which one are or not sync, etc

 

 

cp /usr/share/defaults/config_base.conf /usr/share/defaults/config_base.conf.bak

 

 

Locate the following portion of code in the file :

 

 

(syslog-ng.conf)

config class syslog {

 

category "confpp"

 

singleton enable

 

configsyncd enable

 

fields {

 

...

 

include {

 

display "Include Data"

 

type string

 

appdata "unix_config_syslog.replace.include"

 

clustered enable

 

configsyncd enable

 

}

 

...

 

}

 

nested remote_server

 

}

 

 

Change configsyncd enable to configsyncd disable.

 

Save the modification.

 

 

3. Reload the services in forceload mode

 

 

touch /service/mcpd/forceload bigstart restart

 

 

 

After that, when you create a syslog server with a localip, the local ip is hosted in the bigip_base.conf, as in the 10.2.2 versions and above !

 

 

Thanks Kevin White from F5 for the tips :)