Forum Discussion

Cirrus

Aug 25, 2020

WAF Event Log on BIG-IQ not Real - Time

Hi all We have BIG-IQ system. But At this time WAF event log on BIG-IQ not real -time We have check event log on BIG-IP Device all ok. But on BIG-IQ not real -time Plz help me BIG-IQ: Time: Last ...

Cirrus

Sep 01, 2020

Yep .Currently I see requests logged on BIG-IP, but not on BIG-IQ.

I have congfig remote log profile, then attached it to VS.

I sent to you information detail attach picture.

Thanks

Hung Hoang

Ivan_Chernenkii
Employee
Sep 01, 2020
Is 10.0.103.11 IP of LogNode or IP of BIG-IQ?... Make sure that BIG-IQ logging is configured through LogNode (https://techdocs.f5.com/kb/en-us/products/big-iq-security/manuals/product/bigiq-security-administration-4-4-0/16.html) and it is active.

Thanks, Ivan
- Hoang_Hung
  Cirrus
  Sep 01, 2020
  Yep
  IP address 10.0.103.11, 10.0.103.12 and 10.0.103.13 iss IP for Lof Node (BIG-IQ DCD)
  all Node is active now .
  
  Thanks
  Hung Hoang
- Ivan_Chernenkii
  Employee
  Sep 01, 2020
  Hoang,
  
  In such case, from configuration point of view, all looks correct and should work.
  The only thing that you can do is gather tcpdumps on BIG-IP, Log Nodes, BIG-IQ and check how remote logging passes... and look at logs on BIG-IP, Log Nodes, BIG-IQ to find some errors.
  There is no way to provide more help without access to the system.
  
  If you won't find any other helpful debug information, then I would suggest you to open official SR for F5,
  
  Thanks, Ivan