Forum Discussion
Jiwook
Nimbostratus
NimbostratusHow I configure syslog included specific string at /var/log/ltm ?
here is our syslog configuration sys syslog { auth-priv-from notice auth-priv-to emerg clustered-host-slot enabled clustered-message-slot disabled console-log enabled cron-from warning cr...
JiwookNimbostratus
NimbostratusActually, I want to include expired Ssl certification log on /var/log/ltm to syslog. I try to test some solutions on devcentral, but there are many of different suggestions and make me confused 😞
I need to filter and include some log lines contained string 'expire' to syslog
Ok, but it looks easy, there are native configurations that you can apply to meet your requirement:
This is one on the crontab daemon executed every day:
https://support.f5.com/csp/article/K14318
You can send alert by email, or monitor by SNMP the F5:
https://support.f5.com/csp/article/K15288
You can be create a filter to matches a specific message-id and transmits it to the local-syslog log publisher.
From the CLI enter following commands:
tmsh create /sys log-config publisher local-syslog destinations add { local-syslog }
tmsh create /sys log-config filter filter_cert_will_expire message-id 01420008 publisher local-syslog
tmsh create /sys log-config filter filter_cert_expired message-id 01420007 publisher local-syslog
