How to identify who remove the Virtual server

[Gajji]

How to identify who remove the Virtual server from LB,

[SanjayP]

From Bash shell:

cat /var/log/audit | grep "name_of_vs"

cat /var/log/audit.1 | grep "name_of_vs"

zcat /var/log/audit.*.gz | grep "name_of_vs"

From GUI:

Sytem -> Logs --> Audit --> search with VS name (date/time range can also be provided)

[Gajji]

From GUI:

Sytem -> Logs --> Audit --> search with VS name (date/time range can also be provided)

How to use it?

i am using any name on name filed and on Event putting Virtual server name but nothing is coming

[SanjayP]

It should come. Not sure, if GUI is not able to show the past days logs. In that case, check from the bash shell.

You can also take a look at https://support.f5.com/csp/article/K09050750

[SanjayP]

To add more, BIGIP logs are retained upto last 8 days by default. If remote logging is configured, any logs before 8 days you might need to check on the remote syslog server.

[Ahmed_Galal]

easy way to copy audit via scp to ur PC then search with VS name