Extended logging to Splunk servers beyond Syslog & Analytic Profiles & iRules.

You might start with a Request Logging Profile:

AskF5 | Manual Chapter: Configuring Request Logging

Also look at

Adding the body of requests/responses to the data being logged to Splunk via iRule.

which has a pretty comprehensive irule for sending detailed information formatted for Splunk (ignoring the attempt to send the payload).

> I personally do not believe that the F5’s should be part of Cyberfusions security suite relative to the detailed information that is being requested to be sent externally.

In many cases, the BigIP is supplying required information (such as client IP) via headers and other insertions, and so the logging on webservers should be configured to use things like X-Forwarded-For as the client IP address.

Hello,

Thank you for the response.

About the request logging, particularly " From the Pool Name list, select the pool that includes the node log server as a pool member." I take it that the pool that was created (splunk servers receiving the logs) would be the pool selected?

For the environment in question, a HTTP rule would not work well. All VIPS are defined for HTTPS and all pool members in all pools have HTTPS bound to them.

I will also test with x-forwarding enabled.

The requirement " analysts require end-to-end visibility in relation to network connection events in order to appropriately track potential threats, potentially malicious activity and assist in attack path validation during Cyber events & Cyber incident investigations. Due to the fact that a good majority of our Web-based traffic utilizes F5 VIPs to frontend infrastructure it makes it nearly impossible to determine the actual source of traffic when investigating Cyber events & Cyber incidents on victim infrastructure. The source IP that gets logged in the majority of all host logs is the IP of the VIP"

they are asking to see all traffic, end to end with no obfuscation whatsoever. The environment is such that the actual source addresses are from all over the world. IMHO I do not believe that the function of the F5's is to act as an agent to populate a SIEM. As the environment is using APM (replaced Microsoft Threat Management Gateways) there will be added overhead on the F5's as well.

Splunk destination hosts are defined as Log publishers based on F5 configuration documentation. Splunk destination hosts are in a pool.

Splunk destination hosts are defined as log destinations. As this is APM there are actually 2 destinations defined. One is HSL, which is defined for the Splunk pool.

Another element is syslog instance that forwards to the HSL element.

Access policyies logging created. Access profiles created for each policy created.

Client SSL profiles also created for each instance.

So all syslog traffic is being sent to the Splunk destinations. In fact everything that is defined is sending logs to the Splunk destinations. However, since the beginning of this project the Splunk folks continue to maintain that they "are not seeing all the traffic we would expect to see."

The customer is asking that the F5's perform the heavy lifting in an attempt to avoid spending money on taps, port aggregators and a local flow collecter / netflow host / local Splunk logging host.