F5 Request Logging Profile is not workking

Forums Technical Forums
, ,
1

HI

I need some guidance regarding an F5 BIG-IP LTM Request Logging profile configuration.

Have configured a Request Logging profile on an HTTPS virtual server to send request logs to a remote syslog/logging server. However, the expected request logs are not being received / are not reaching the remote logging server.

HTTPS VIP is configured with http profile assinged

Verified the required ports are open in destination log server and in Firewall

This log Profile is mapped with HTTPS Virtual server

Log pool POOL_HSL is configured with one logging server

Conifg below

ltm profile request-log LOG_HSL {

app-service none

defaults-from request-log

log-request-logging-errors yes

proxy-close-on-error no

proxy-respond-on-logging-error no

proxy-response none

request-log-error-pool none

request-log-error-protocol mds-udp

request-log-error-template none

request-log-pool POOL_HSL

request-log-protocol mds-udp

request-log-template "$(CLIENT_IP) $(CLIENT_PORT) $(SERVER_IP) $(SERVER_PORT) $(VIRTUAL_NAME) $(HTTP_METHOD) $(HTTP_STATCODE) $(DATE_HTTP)"

request-logging enabled

}

2

Hi Muthukumar,

I have a few questions: is the remote syslog server in the same Vlan as the BIG-IP, or is it reached through a route?
Could you take a packet capture to confirm whether the BIG-IP is sending the traffic?

tcpdump -ni 0.0:nnnp -s0 host and dst_port -w /var/tmp/captura.pcap

Keep in mind that HSL traffic is send from a SelfIP, so if the syslog server is reached through a route, that route must be configured in TMM (Network > Routes), not as management route.

Also, make sure the firewall rules allow the SelfIP as the source.

Finally, check the status of POOL_HSL: if the member is marked down, the BIG-IP won’t send the logs.

Configuring Request Logging

This guide is for version 14.x, but the feature hasn’t chenged much in later versions.

Best regards

Note I used AI to help me with the translation.

Quiroman81

3

Thanks for the feedback .. i will check these details .. based on link shared is it mandortory to have http health monitor for the request log pool conifg ? since the request log config uses udp

4

Hello Muthukimar

You shouldn’t use http health monitor.
For me I used in this case a ICMP health monitor.

Best regards,

Quiroman81

5

Thanks .. I will check these details ..
Regards,

Muthu

6

HI Quiroman81,
During the Wireshark analysis, we observed that HSL traffic is reaching the remote logging server, but the TCP payload contains the configured template strings rather than the expected runtime values ,
from the packet cpature :

image
image1536Ă—416 62.9 KB

Is anyhing wrong with Request Log profile config shared earlier or its due to invalid template string ?

Your help would be appreciated .
Regards,

Muthu

7

Hello Muthukumar,

I believe template variables should be enclosed in curly brackets, not parentheses.

https://my.f5.com/manage/s/article/K00847516

Regards,
Juan

8

I agree with this. Alternatively, you can just remove any brackets or parentheses e.g. $CLIENT_IP

9

Hi Juanboticari0
Thanks . Will check these .

Regards,

Muthu

10

HI Michael ,

Sure . Thanks