syslog over tcp and define management IP as source

Forums Technical Forums
, ,
1

Hello

I used following method to add syslog server ip with tcp port. can anyone help me how to define source IP (management IP) to send logs to syslog server.

Configuring the BIG-IP system to log to the remote syslog server using TCP protocol Impact of procedure: Performing the following procedure should not have a negative impact on your system.

1.Log in to tmsh by typing the following command: tmsh

2.To log to the remote syslog server using the TCP protocol, use the following command syntax:

modify /sys syslog include “destination remote_server {tcp(\”\" port (514));};filter f_alllogs {level (debug…emerg);};log source(local);filter(f_alllogs);destination(remote_server);};"

For example, to log to the remote syslog server 172.28.68.42, type the following command:

modify /sys syslog include “destination remote_server {tcp(\“172.28.68.42/” port (514));};filter f_alllogs {level (debug…emerg);};log {source(local);filter(f_alllogs);destination(remote_server);};”

2

Hello,

For your asked you have to a add route to force traffic passing by management route.

You have to know that routing for mgmt is different of business routing.

SO connect to F5 using cli and enter in tmsh then add your route:

tmsh create /sys management-route  network / gateway

example

tmsh create /sys management-route syslog-route network  172.28.68.42/32 gateway 1.1.1.1

1.1.1.1 will be the management gw

Then save configuration

tmsh save /sys config

This article describe routing trough mgmt interface: myF5

Keep me update,

Regards,

3

Hi,
I did the following as described above:

# modify /sys syslog include “destination remote-server {tcp(192.168.10.26 port (514));};”

Checking the configuration:

# list /sys syslog

sys syslog {

include “destination remote-server {tcp(192.168.10.26 port (514));};”

}

I added and deleted the following:

image_346147.png
image_346147.png556×287 6.18 KB

Added the configuration above (GUI), list /sys syslog shows:

# list /sys syslog

sys syslog {

include “destination remote-server {tcp(192.168.10.26 port (514));};”

remote-servers {

remotesyslog1 {

host 192.168.10.26

}

}

}

Adding Remote Syslog Server with GUI sends UDP packets.

Removing it, no packets are send to the syslog-server.

This was seen with tcpdump on the F5 and the firewall between the F5 BIG-IP and the syslog-server.

What do I missing, to make it working?

Thanks in advance
Christian

4

TCP remote servers are never shown with this command

list /sys syslog

You need to use

list /sys syslog remote-server

5

@Greifensteiner , In include statement you actually adding pure syslog-ng configuration, not tmos directives/commands.

In syslog-ng configuration “destination remote-server …” is only a definition of log destination that has to be connected to some log source.

You can do it with log and filter statement.

Example that sends part (match(\“: 0199\”) of APM (facility(local1)) logs to 192.168.100.1:514:

include "

filter filter_logs { facility(local1);match(\“: 0199\”);};

destination destiantion_logs { tcp(\“192.168.100.1\” port (514) localip(\“192.168.100.2\”));};

log {

source(s_syslog_pipe);

filter(filter_logs);

destination(destiantion_logs);

};

"