Forum Discussion

nznznznzF5_2991's avatar
nznznznzF5_2991
Icon for Nimbostratus rankNimbostratus
May 02, 2018

Cannot see any HSL

I'm currently running BIG-IP 12.1.0 Build 2.0.1468 Hotfix HF2 and I have a iRule that does HSL logging so we can send all the useful HTTP payload to splunk via port 9514. The members in the pool are only reachable via the management interface. From what I understand is that HSL is now sent via TMM interfaces? Is this correct? or is this rule applicable only for system generated syslog that are not derived from iRule.

 

When I run a tcpdump by explicitly assigning mgmt as the interface I can't see any of the syslog during the time the iRule was applied.

 

Snippet from the iRule:

 

set static::_PROD_PROD_VWSOSD_syslog /Common/POOL_PROD_SPLUNK_SOAP set hsl [HSL::open -proto UDP -pool $static::_PROD_PROD_VWSOSD_syslog ] HSL::send $hsl "Client: $client -> VIP:$vip [HTTP::payload]"

 

1 Reply

  • You have answered your own question. HSL sends logging out of a TMM interface based on the routing information. If you don't have a specific route, HSL will send logs towards your default gateway.