Technical Forum
Ask questions. Discover Answers.
cancel
Showing results for 
Search instead for 
Did you mean: 
Custom Alert Banner

How to identify who remove the Virtual server

Gajji
Cirrostratus
Cirrostratus

How to identify who remove the Virtual server from LB,

5 REPLIES 5

SanjayP
MVP
MVP

From Bash shell:

 

cat /var/log/audit | grep "name_of_vs"

cat /var/log/audit.1 | grep "name_of_vs"

zcat /var/log/audit.*.gz | grep "name_of_vs"

 

From GUI:

 

Sytem -> Logs --> Audit --> search with VS name (date/time range can also be provided)

Gajji
Cirrostratus
Cirrostratus

From GUI:

 

Sytem -> Logs --> Audit --> search with VS name (date/time range can also be provided)

 

How to use it?

 

i am using any name on name filed and on Event putting Virtual server name but nothing is coming

It should come. Not sure, if GUI is not able to show the past days logs. In that case, check from the bash shell.

 

You can also take a look at https://support.f5.com/csp/article/K09050750

To add more, BIGIP logs are retained upto last 8 days by default. If remote logging is configured, any logs before 8 days you might need to check on the remote syslog server.

Ahmed_Galal
Cirrostratus
Cirrostratus

easy way to copy audit via scp to ur PC then search with VS name