CLI Command to check logs

The logs are in /var/log with file name ltm. The /var/log -file system is fairly limited in size, and if you collect a lot of log information, it may fill up pretty fast. If you want more than that then need some external tool like Splunk etc to collect and index logs for easy search.

 

More details on below link:- https://support.f5.com/csp/article/K13367rotation

 

you can use below command to verify all available logs on F5.

 

1. Go to /var/log folder

cd /var/log

 

1. Type below command to verify the logs

zcat ltm.*.gz | grep < nodeip>

 

or

 

zcat ltm.*.gz | grep < pool name>

 

or

 

zcat ltm.*.gz | grep

 

you can use below command to verify all available logs on F5.

 

1. Go to /var/log folder

cd /var/log

 

1. Type below command to verify the logs

zcat ltm.*.gz | grep < nodeip>

 

or

 

zcat ltm.*.gz | grep < pool name>

 

or

 

zcat ltm.*.gz | grep

 

Hi MKumar,

you can read and filter the logs stored on your hard disks via TMSH.

[root@f501:Active:Standalone] config  date
Tue Apr  2 12:51:06 CEST 2019
[root@f501:Active:Standalone] config  tmsh
root@(f501)(cfg-sync Standalone)(Active)(/Common)(tmos) show sys log ltm range 2019-03-28 lines 5 | grep warn
ltm 03-28 08:25:10 warning f501 tmsh[19996]: [api-status-warning] sys/db, properties : deprecated : connection.syncookies.threshold, pvasyncookies.virtual.connthresholdhigh, pvasyncookies.virtual.invalidthreshold, pvasyncookies.virtual.maxsyncache 
ltm 03-28 08:25:25 warning f501 tmsh[19996]: [api-status-warning] sys/db, properties : deprecated : connection.syncookies.threshold, pvasyncookies.virtual.connthresholdhigh, pvasyncookies.virtual.invalidthreshold, pvasyncookies.virtual.maxsyncache 
ltm 03-28 08:25:46 warning f501 tmsh[19996]: [api-status-warning] sys/db, properties : deprecated : connection.syncookies.threshold, pvasyncookies.virtual.connthresholdhigh, pvasyncookies.virtual.invalidthreshold, pvasyncookies.virtual.maxsyncache 
ltm 03-28 08:26:02 warning f501 tmsh[19996]: [api-status-warning] sys/db, properties : deprecated : connection.syncookies.threshold, pvasyncookies.virtual.connthresholdhigh, pvasyncookies.virtual.invalidthreshold, pvasyncookies.virtual.maxsyncache 
root@(f501)(cfg-sync Standalone)(Active)(/Common)(tmos) 

To become able to read logs older than the last 8 days you have to increase the logrotate.logage sys-db variable, so that your logfile are not getting auto-deleted after 8 day.

root@(f501)(cfg-sync Standalone)(Active)(/Common)(tmos) list /sys db logrotate.logage
sys db logrotate.logage {
    value "8"
}
root@(f501)(cfg-sync Standalone)(Active)(/Common)(tmos) modify /sys db logrotate.logage value 14
root@(f501)(cfg-sync Standalone)(Active)(/Common)(tmos) list /sys db logrotate.logage
sys db logrotate.logage {
    value "14"
}
root@(f501)(cfg-sync Standalone)(Active)(/Common)(tmos) 

Cheers, Kai