syslog-ng

Okay I figured out the solution, but first the problem. The ltms running v9 worked fine when redirecting the log files to the remote syslog server, which I have no control over. Each v9 system has a seperate log file on the syslog-ng server, no mode needed to be made to the syslog-ng.conf file on the v9 ltms.

 

 

So why did F5 change this behavior on the v10 systems?

 

 

With v10 systems a template is used that formats the syslog data sent to a remote syslog server in the form of "timestamp local/$HOST .... message". This was causing all v10 ltm system logs to be written to a single file named "local" on the remote syslog-ng server.

 

 

Numerous attemps to rewrite the template failed, in fact it broke logging altogether and F5 supported stated that a rewrite of the template was not supported and that I need to redo my syslog server to handle the way F5 ltm was sending the data, so much for support.

 

 

So back to the drawing board. The goal was to have seperate log files on the syslog server for each v10 system. I initially played with the v10 syslog-ng.conf "options" section with out any luck. Initially I added "use_fqdn(yes)" but this did not work. With this config option the syslog server still received the data stream in the following format, "timestamp local/fqdn .... message". Still causing the remote syslog-ng server to write all the v10 ltm data to a single file named local.

 

 

The solution appears to be setting the options in the following manner

 

 

 

bigpipe syslog include '"options {

 

dir_perm(0755);

 

perm(0644);

 

chain_hostnames(no);

 

use_fqdn(yes);

 

keep_hostname(no);

 

stats(0);

 

log_fifo_size(2048):

 

};"'

 

 

So now each v10 ltm has a seperate log file on the remote syslog server and uses the fqdn in message.

 

 

-Rob