Technical Forum
Ask questions. Discover Answers.
Showing results for 
Search instead for 
Did you mean: 

Logging Facilities Missing in /sys syslog all-properties


Can some explain the limitations on the available logging facilities via the edit /sys syslog all-properties command?


This question stems from an issue I'm having with HSL/Splunk log offload configuration. In the past, configuration via the more basic "remote servers" component was able to offload items from /var/log/ltm such as TCP Resets (if configured via /sys db tcpreset.log value) and SSL Handshake failures.

However, since transitioning to include destination d_remote_loghost {target IP/ports} and a basic HTTP request iRule, I am unable to see any of these messages.


One would think that local0-5 (and local7) would be available for offload configuration but clearly a syntax error is returned.


What am I missing / interpreting wrong in the configuration instructions to both A) get more in-depth /var/log/ltm content, and B) have it successfully offload to Splunk?