System authentication logging
Hi, for some SIEM scenarios I need to have the BigIP login events within our remote log management. Within the GUI I can see the following event if an login failed: Fri Aug 23 09:51:59 CEST 2019 USERNAME 0-0 httpd(pam_audit): User=USERNAME tty=(unknown) host=192.168.178.2 failed to login after 1 attempts (start="Fri Aug 23 09:51:57 2019" end="Fri Aug 23 09:51:59 2019").: For remote logging I've configured the log destination, publisher and a filter. The log destination based on HSL. Within the filter I've severity "information" and source "all". The problem is that the authentication events will not be sended to the remote syslog. All other messages will be sended. If I activate the "remote logging" feature where I receive all messages and where I don`t have any possibility to change the stuff which will be sended I`ll receive the log message regarding successfully and failed logon. Is it possible to receive the authentication events also with only the usage of HSL!? The logs are available at /var/log/secure and /var/log/audit, but they will not be transferred to the remote syslog. I`ve already tested around with some different settings. Within the options for logging I've enabled the audit (tmm / mcp) logging. Any Ideas!? Within the documentation I can only find some informations that the authentication logs are available within /var/log/secure and/or /var/log/audit, but there are no informations how to transfer them. Thanks and Regards seilemor
Log Stream Substitutions
Hi, I'm trying to help w/ moving a site to ssl only. I think I have things dialed in well enough and it looks like it's working well. As a bonus, I'd like to log the URLs that the stream matches. In other words, when I do the substitution in the HTTP_RESPONSE, is there any way to capture the greater context around the substitution so the web team knows which URLs need to be fixed (they want to use the F5 to jump start the process and fix it on the back end as time permits). So the iRule (stolen from dev central) is like this: when HTTP_REQUEST { tell server not to compress response HTTP::header remove Accept-Encoding disable STREAM for request flow STREAM::disable } when HTTP_RESPONSE { catch and replace redirect headers if { [HTTP::header exists Location] } { HTTP::header replace Location [string map {"http://" "https://"} [HTTP::header Location]] } only look at text data if { [HTTP::header Content-Type] contains "text" } { create a STREAM expression to replace any http:// with https:// STREAM::expression {@http://@https://@} enable STREAM STREAM::enable } } when STREAM_MATCHED { log local0. "Matched [STREAM::match]" } It would be a great help if in the stream_matched event, I could log something useful for the web developers. Thanks for any input. Mike
Attributing object to log messages
Since upgrading to v12.1.1 we're seeing SSL errors in /var/log/ltm. I believe this is due to behavior starting in v12.0 per SOL15292 ("Note: Beginning in 12.0.0, the BIG-IP system automatically logs SSL handshake failure information through standard logging"). However the log messages (samples below) do not indicate to which object they are attributed. Is there a way to determine which object throws these errors? Some (no shared ciphers) may not require further scrutiny but would like to trace some down to see if issue is something we need to pursue further. Sample messages (timestamp and hostname removed; all following appear as 'warning' level): tmm[22716]: 01260009:4: Connection error: ssl_cn_decrypt_fin_cb:2034: fin decryption failed (20) tmm7[22717]: 01260009:4: Connection error: ssl_cn_decrypt_fin_cb:2034: fin decryption failed (20) tmm5[22717]: 01260009:4: Connection error: hud_ssl_handler:1224: codec alert (20) tmm3[22716]: 01260009:4: Connection error: ssl_passthru:4015: not SSL (40) tmm4[22717]: 01260009:4: Connection error: ssl_passthru:4015: not SSL (40) tmm4[22717]: 01260009:4: Connection error: ssl_hs_rxhello:7295: unsupported version (40) tmm3[22716]: 01260009:4: Connection error: hud_ssl_handler:1224: codec alert (20) My question may be better stated as: "Is there a document relating the log.ssl.level DB variable to the information logged to /var/log/ltm?" I see SOL17045 regarding some server-side logging that requires debugging and was hoping to find something documented rather than 'play' with log levels and observe results.Disable Firewall Event Logging for Traffic on a Forwarding Virtual Server.
I have a Forwarding (IP) virtual server, with SNAT Automap. Allowed sources is set to 172.16.0.0/16, and destination is 10.0.0.0/8. The Big-IP has AFM enabled (default deny), with a global policy, but no security policy on this virtual server. In spite of that, the event logs (Security -> Event Logs -> Network -> Firewall) show many entries for traffic forwarding through this VS. The context is shown as "Virtual Server" and the "Policy Type" and "Policy Name" fields are empty. The majority of these entries are for clients hitting a particular server and port, which I specifically don't want to log, due to the volume. Problem is, I can't find what setting is actually causing them to be logged in the first place. Can anyone shed light on this? I already have a global-policy rule that allows 172.16.0.0/16 to that server and port without logging, but this doesn't stop the log entries in the virtual server context. I temporarily added a security policy to the VS, with a similar rule to the one in the global policy, but that also failed to stop these entries appearing. The virtual server has the default fastL4 profile, and no logging parameters that I can see. Other modules enabled: LTM, GTM, ASM, APM.Stop iControl logging entries in Local Traffic on F5
Hello I am using Powershell to run a script against my F5s and everytime the script runs I get the following log entry in the Local Traffic. Is there a way to stop logging for iControl calls to the F5? Fri Aug 10 03:34:09 UTC 2018infoNCRASHNLB01soap[9133] src=10.100.2.44, user=report, method=get_version, action=urn:iControl:System/SystemInfo Fri Aug 10 03:34:09 UTC 2018infoNCRASHNLB01soap[9133] src=10.100.2.44, user=report, method=get_version, action=urn:iControl:System/SystemInfo Fri Aug 10 03:34:09 UTC 2018infoNCRASHNLB01soap[9133] src=10.100.2.44, user=report, method=get_hostname, action=urn:iControl:System/Inet Fri Aug 10 03:34:09 UTC 2018infoNCRASHNLB01soap[9133] src=10.100.2.44, user=report, method=get_system_information, action=urn:iControl:System/SystemInfo Fri Aug 10 03:34:09 UTC 2018infoNCRASHNLB01soap[9133] src=10.100.2.44, user=report, method=get_hardware_information, action=urn:iControl:System/SystemInfo Fri Aug 10 03:34:09 UTC 2018infoNCRASHNLB01soap[9133] src=10.100.2.44, user=report, method=get_all_software_status, action=urn:iControl:System/SoftwareManagement Fri Aug 10 03:34:09 UTC 2018infoNCRASHNLB01soap[9133] src=10.100.2.44, user=report, method=get_provisioned_list, action=urn:iControl:Management/Provision Fri Aug 10 03:34:09 UTC 2018infoNCRASHNLB01soap[9133] src=10.100.2.44, user=report, method=get_failover_status, action=urn:iControl:Management/DeviceGroup Fri Aug 10 03:34:09 UTC 2018infoNCRASHNLB01soap[9133] src=10.100.2.44, user=report, method=get_product_information, action=urn:iControl:System/SystemInfo Fri Aug 10 03:34:09 UTC 2018infoNCRASHNLB01soap[9133] src=10.100.2.44, user=report, method=set_active_folder, action=urn:iControl:System/Session Fri Aug 10 03:34:09 UTC 2018infoNCRASHNLB01soap[9133] src=10.100.2.44, user=report, method=set_recursive_query_state, action=urn:iControl:System/Session Fri Aug 10 03:34:09 UTC 2018infoNCRASHNLB01soap[9133] src=10.100.2.44, user=report, method=get_certificate_list, action=urn:iControl:Management/KeyCertificate
Get rid of log requests from geo IP blocking
Our ASM log gets flooded with requests blocked from Geo IP blocking filter. This makes it hard to find important log events. I have not found any way to get rid of these alerts: In the blocking settings: We are now on version 12 hf2 but it has been the same since version 11.6. These alerts are also sent to remote log even though it's set to not alarm. Please advice.iRule to log a specific field in POST data
I'd like to have an irule log the authentication attempts for a web application I have that takes POST data. How do I pull a specific POST parameter out of the http content? Suppose I have a login page, http://example.com/loginform.html" that will have POST data for "username" and "password". So, right now, I can detect the presence of the 'username' parameter in my submitted form by looking for HTTP::method as "POST" to HTTP::uri "login-form.html" and checking that [HTTP::payload] contains "username". But I'd like to be able to generate a syslog saying "User $username attempted login from [IP::client_addr]:[TCP::client_port]" How do I best extract that "username" value from the payload data for logging without altering the actual transaction at all? Thanks!Application Security Log Event Size
Hi We try to integrate the Application Securit Logs into Splunk. Now we realized, that the Event-Field of the Application Security Logs contains only a truncated version of the Request. Is there a possibility to extend the Length of this Field in BIG-IP 11.2.0 to get the full Request? Regards sbu
