For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

swjo_264656's avatar
swjo_264656
Icon for Cirrostratus rankCirrostratus
Dec 02, 2016

syslog filter to 2 remote server

Hi   I will be very grateful to you if anyone advice configure.   I`m going to send syslog to two syslog server.   modify sys syslog { include "filter f_ltm {facility(local0) and level(debug....
application delivery
BIG-IP
LTM
cjunior's avatar
cjunior
Icon for Nacreous rankNacreous
Dec 02, 2016

Hi,

When I have complex text, I'd prefer to use "edit" instead of "modify" when its possible, so, maybe it would useful to you.

Run 

edit sys syslog
then replace content:

modify syslog {
    include "
    filter f_ltm {
        facility(local0)
        and level(debug..emerg)
        and not match(\"Clock has unexpectedly adjusted by\")
        and not match(\"Tmstat::updateSensorTbls: HAL SenSvc error: BourneSeepromDev\")
        and not match(\"http_process_state_prepend\") and not match(\"Tcpdump\");
    };
    destination d_logsvr {
        udp(\"192.168.0.29\" port(514));
    };
    destination d_logsvr2 {
        udp(\"192.168.0.30\" port(514));
    };
    log {
        source(local);
        filter(f_ltm);
        destination(d_logsvr);
    };
    log {
        source(local);
        filter(f_ltm);
        destination(d_logsvr2);
    };"
}

I've not tested, but it should work.

Regards.