Forum Discussion
drumrolfe_11624
Nimbostratus
NimbostratusSyslog Distribution
Hello:
I have a situation where we receive raw syslog from remote devices across the WAN, but have multiple syslog destinations that need to receive the syslog messages (ArcSight, Splunk, etc).
I want to know if it is possible to configure the Big-IP 10200 to have a virtual server IP to receive the syslog messages from remote devices across the WAN and then duplicate them to a pool of syslog servers that are on the LAN. The purpose of this would be to de-duplicate syslog traffic across the WAN.
Thanks!
Hi, you can duplicate syslog messages to another pool. This article descirebes how to do it link.
Vitaliy_SavransNacreous
Hi, you can duplicate syslog messages to another pool. This article descirebes how to do it link.
drumrolfe_11624Thank you!
nitass_89166Noctilucent
is this usable?
iRules High Speed Logging - Spray Those Log Statements by Jason Rahm
https://devcentral.f5.com/articles/irules-high-speed-logging-spray-those-log-statements.UvOD3rSjZQI- drumrolfe_11624Thank you! From what I have read, HSL is a feature to send the logging messages of the F5 to multiple destinations. It seems this feature is not useful for configuring the F5 to act as a syslog destination for remote devices to clone the received syslog to multiple local destinations. Perhaps I am misunderstanding HSL?
nitassEmployee
is this usable?
iRules High Speed Logging - Spray Those Log Statements by Jason Rahm
https://devcentral.f5.com/articles/irules-high-speed-logging-spray-those-log-statements.UvOD3rSjZQI- drumrolfe_11624Thank you! From what I have read, HSL is a feature to send the logging messages of the F5 to multiple destinations. It seems this feature is not useful for configuring the F5 to act as a syslog destination for remote devices to clone the received syslog to multiple local destinations. Perhaps I am misunderstanding HSL?