For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Yoshi_126949's avatar
Yoshi_126949
Icon for Nimbostratus rankNimbostratus
Mar 18, 2014

User audit via HSL

Hi,   I'm trying to get some of the F5 logging into our syslog server. What I specifically need are the user login records from the device. I've configured a remote syslogger and that seems okay. ...
management
TMOS
Kevin_Stewart's avatar
Kevin_Stewart
Icon for Employee rankEmployee
Mar 25, 2014

I was having a heck of a time getting this to work through the Log Filters configuration, but I was able to make it log logon and logoff with the following TMSH command:

tmsh modify sys syslog include "destination remote_server {udp(10.70.0.99 port (514));};filter f_auths {facility (auth,authpriv) and level (debug...emerg);};log {source(local);filter(f_auths);destination(remote_server);};"

To disable this:

tmsh modify sys syslog include none