Forum Discussion
tbriscoe_90614
Nimbostratus
NimbostratusViprion F5 sending logs to Qradar need the slot number removed
when sending the log to qradar it comes up in the format of slot/hostname
<132>Aug 11 15:27:37 slot1/testf502 warning tmm[11723]: 01260026:4: No shared ciphers between SSL peers 185.181.102....
Steps to remove "slot1/" from remote syslog.
https://support.f5.com/csp/article/K13333
1) tmsh modify /sys syslog remote-servers none
2) tmsh edit /sys syslog all-properties
3) Find the line "include none" and replace "none" with below include statement (press "i" for insert mode):
include "
options {
keep_hostname(no);
};
filter f_remote_loghost {
level(warn..emerg);
};
destination d_remote_loghost {
tcp(\"IP_SERVER_1\" port(514));
udp(\"IP_SERVER_2\" port(514));
};
log {
source(s_syslog_pipe);
filter(f_remote_loghost);
destination(d_remote_loghost);
};
"