cancel
Showing results for 
Search instead for 
Did you mean: 

HSL Loggin & Splunk

REddy
Nimbostratus
Nimbostratus

Hi Everyone,

We are trying to build to HSL logging via the irules to the splunk. Here are the steps implemented so far.

1. created a UDP 514 pool with remote logging servers.

when CLIENT_ACCEPTED {
set client_address [IP::client_addr]
set syslogpool "splunk_hsl_pool_514"
set vip [IP::local_addr]
set hsl [HSL::open -proto UDP -pool $syslogpool]
}
when CLIENTSSL_HANDSHAKE {
set ssl_cipher_negotiated [SSL::cipher name]
set ssl_version [SSL::cipher version]
#log local0. "Ciphers: $ssl_cipher_negotiated & the version :$ssl_version"
HSL::send $hsl "Ciphers: $ssl_cipher_negotiated & the version :$ssl_version"
}

3. The irule applied on to the Virtual servers.

I couldnt see anything when i search in splunk. It would be great if any one can help me with this.

1 REPLY 1

neeeewbie
MVP
MVP

Hi

did you see any log on /var/log/ltm ?

please check logs