on 27-May-2010 11:27
Sometimes I need to log information from iRules to debug something. So I add a simple log statement, like this:
when HTTP_REQUEST { if { [HTTP::uri] equals "/secure" } { log local0. "[IP::remote_addr] attempted to access /secure" } }
when HTTP_REQUEST { if { [HTTP::uri] equals "/secure" } { log local0. "##[IP::remote_addr] attempted to access /secure" } }
tmsh modify sys syslog include '" filter f_local0 { facility(local0) and not match(\": ##\"); }; filter f_local0_customlog { facility(local0) and match(\": ##\"); }; destination d_customlog { file(\"/var/log/customlog\" create_dirs(yes)); }; log { source(local); filter(f_local0_customlog); destination(d_customlog); }; "'
tmsh save / sys config
tmsh restart sys service syslog-ng
tmsh modify sys log-rotate syslog-include '" /var/log/customlog { compress missingok notifempty }"'
tmsh save / sys config
SVS,
I had to write a simple iRule and log Client IP address which is hitting one particular VIP(LDAP) and to a separate log file and I am running 11.6.0 version.
Could you please tell me how my iRule should look like for the custom log file to work and how should that reflect in the syslog-ng file.
when CLIENT_ACCEPTED { log local0. "Client IP address:{IP:client_addr]" } }
Thanks Balaji
I tried searching for more information in the TMSH Reference Guide 12.0 but it does not go into details about the coding for the "Include" option of syslog on F5.
I would appreciate it if someone could point me to a resource where I can learn more on how to use this feature.
I have an issue with the log rotation not working anymore but it seems the config is correct
dehama01@(f5-lb-dmz-1)(cfg-sync Changes Pending)(Active)(/Common)(tmos)# list sys log-rotate syslog-include
sys log-rotate {
syslog-include "
/var/log/IPI_L4 {
compress
missingok
notifempty
}
var/log/GeoIP {
compress
missingok
notifempty
}
"
}
I get this error with log rotation a verify config does not show any error
[root@f5-lb-dmz-1:Active:In Sync] images # logrotate -f /etc/logrotate.conf
error: could not change directory to '.'error: syslog-ng:70 unknown option 'var' -- ignoring line
error: syslog-ng:74 unexpected }
error: found error in file syslog-ng, skipping
looking into the syslog-ng config file i see this
70 # local0.none,local2.none;local4.none;local5.none;local6.none \
71 # /var/log/messages
72 filter f_notLocal0 {
73 not facility(local0);
74 };
I have a open case with F5 support for this log rotate issue