Forum Discussion

Zuke_254875's avatar
Zuke_254875
Icon for Altostratus rankAltostratus
Apr 23, 2019

What /var/log/ are sent to remote syslog?

First, we don't have HSL enabled (yet).

Following an upgrade from 12.1.2 to 13.1.1.4, I ran into an issue where a guest went offline due to Bug ID 724556; processes are issued the kill command but do not actually get removed.

The macabre log message is located in /var/log/restjavad.0.log. 

[SEVERE][3682][14 Apr 2019 10:25:37 UTC][ChildWrapper] Child runner thread was interrupted. Killing child: 05b5a0ab-c243-4fa6-bd66-ea37abc5d398
[SEVERE][3686][14 Apr 2019 10:25:37 UTC][ChildWrapper] Child runner thread was interrupted. Killing child: 05b5a0ab-c243-4fa6-bd66-ea37abc5d398
[SEVERE][3731][14 Apr 2019 10:27:37 UTC][ChildWrapper] Timed out waiting for GET request at http://localhost:8100/tm/sys/ha-status?options=all-properties. Killing child process 4046
[I][3732][14 Apr 2019 10:27:37 UTC][ChildWrapper] Killing IcrdChild process 4046
[SEVERE][3733][14 Apr 2019 10:27:37 UTC][ChildWrapper] Child runner thread was interrupted. Killing child: 0c6e6062-c135-4096-ac2f-d93e6713ea0d
[SEVERE][3738][14 Apr 2019 10:27:37 UTC][ChildWrapper] Child runner thread was interrupted. Killing     child: 0c6e6062-c135-4096-ac2f-d93e6713ea0d
[SEVERE][3781][14 Apr 2019 10:29:37 UTC][ChildWrapper] Timed out waiting for GET request at http://localhost:8100/tm/sys/ha-status?options=all-properties. Killing child process 5436
[I][3782][14 Apr 2019 10:29:37 UTC][ChildWrapper] Killing IcrdChild process 5436

I am trying to set up an alarm when this message is sent.

I don't see that message in our SIEM, so my question is, can /var/log/restjavad.0.log be sent to remote syslog?

application delivery
BIG-IP
logging
restjavad
varlog
  • youssef1's avatar
    youssef1
    Icon for Cumulonimbus rankCumulonimbus
    Apr 23, 2019

    Hi,

    I don't think so.

    I check syslog config directly in the file:

    vi /etc/syslog-ng/syslog-ng.conf

    And it seems that /var/log/restjavad.0.log was not send trough syslog.

    however what I find strange, in the following link F5 tells us that we can send this logs using syslog. but the procedure is not indicated:

    https://f5-automation-labs-dev.readthedocs.io/en/develop/class1/module1/module1.html?highlight=restjavad

    In order to confirm the results of REST API calls made in this lab, it’s recommended to keep GUI/SSH sessions to the BIG-IP devices open. By default, BIG-IP will log all the REST API related events locally to restjavad.0.log . These logs can also be directed to a remote syslog server (see https://support.f5.com/csp/article/K13080). On a side note, the ltm log files listed below contains log messages specific to BIG-IP local traffic management events.

    Regards