send Request Logging through Management IP

[IVD]

Hi,
We have configured Big IP LTM - Request Logging to send logs to an HSL syslog Server.
But I didn't find any way to send those logs through the management IP , so that it doesn't use applications bandwith.

Is there any way to achieve that ?

Thanks for your help

[Paulius]

@IVD On the F5 some configuration exists that will only use the routed interfaces of the device rather than the management IP (interface) of the device. You can test this theory with HSL but going into the CLI and adding a management interface route to the destination but pointed at the appropriate gateway for the management interface. This is assuming that your management interface sits on a different network than the routed interfaces. The following command should be the syntax.

create sys management-route <name> <destination_IP> <destination_mask> <gateway_IP>

If for some reason this syntax doesn't work for you I would start hitting the ? after "management-route" and follow the sub-menus it displays.

[IVD]

Thank you for your answer.

I tried adding a management-route (we have some other management route for DNS or NTP for exemple)
But in this case i can't see anymore traffic send to the HSL server.
If I launch a tcpdump (tcpdump -nni any host <hsl_ip> ) , no packet are sent on any interface.
If I rollback the packets are sent through the routed interface.

any other idea?

[Paulius]

@IVD tcpdump tends to not automatically capture traffic from the mgmt interface so I would adjust your tcpdump to listen on the management interface specifically and see what comes back. Typically if the routed interface is automatically used, adding a route to the management interface routing table will not cause the traffic to stop passing. Most likely the traffic is leaving the management interface but something along the path is most likely blocking the traffic. Please let us know if the tcpdump that specifies the management interface shows this communication. If you see nothing on the management interface I do not believe it can be sent out the management interface in this case.

[Michael_Saleem · Accepted solution]

According to the following article it is not possible to configure request logging to be sent out via the MGMT port (but you can do it by using an iRule and applying it to a virtual server).

Configuring the BIG-IP system to send high-speed logs through the management interface (f5.com)

[IVD]

Thnk you both,
I understand this is not actually possible.
I'll give it a try with the iRule.