For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

seilemor's avatar
seilemor
Icon for Nimbostratus rankNimbostratus
Aug 23, 2019

System authentication logging

Hi, for some SIEM scenarios I need to have the BigIP login events within our remote log management. Within the GUI I can see the following event if an login failed: Fri Aug 23 09:51:59 CEST 2019 ...
event logging
high speed logging
LTM
Andrew-F5's avatar
Andrew-F5
Icon for Employee rankEmployee
Sep 04, 2019

HSL doesn't log events related to management, only system-level events.

K15521451: BIG-IP TMOS operations guide | Chapter 12: Log files and alerts

HSL mechanism can log BIG-IP system-level events, DNS events (for local traffic and global traffic) , Network Firewall events, and Protocol Security Manager events, carrier-grade NAT (CGNAT) events, and distributed denial of service (DDoS) protection events.

Here's a similar DevCentral thread that may be of use, https://devcentral.f5.com/s/question/0D51T00006i7XrlSAE/user-audit-via-hsl.