Need to verify if F5 is sending logs to Syslog Server for local1 Facility
With the syslog setting as below how can i confirm it will send the APM related logs to remote syslog server ? This doc ( https://support.f5.com/csp/article/K15521451 ) says Local1 facility will carry APM related logs but below output does not show anything related to Local 1. Only shows Local6. Can you advise ? (/Common)(tmos)# list sys syslog all-properties sys syslog { auth-priv-from notice auth-priv-to emerg clustered-host-slot enabled clustered-message-slot disabled console-log enabled cron-from warning cron-to emerg daemon-from notice daemon-to emerg description none include none iso-date disabled kern-from debug kern-to emerg local6-from notice local6-to emerg mail-from notice mail-to emerg messages-from notice messages-to warning remote-servers { 10.8.11.11 { description none host 10.8.11.11 local-ip 10.8.22.22 remote-port 514 } } user-log-from notice user-log-to emerg
HTTP Payload logging breaks HTTP Keep-Alive
Afternoon all, I've written an iRule to record the request/response payload on a REST HTTP API. The rule looks like: when CLIENT_ACCEPTED { if { $static::PayloadLoggerDebug or $f5_connection_debug } { log local0.debug "Processing CLIENT_ACCEPTED." } Set the payload logging flag set log_payload 1 } when HTTP_REQUEST priority 800 { if { $static::PayloadLoggerDebug or $f5_connection_debug } { log local0.debug "$log_prefix: Processing HTTP_REQUEST at priority 800..." } Skip logging if no members available if {$splunk_bypass}{ if { $static::PayloadLoggerDebug or $f5_connection_debug } { log local0.debug "$log_prefix: Splunk HSL pool is down. Bypassing logging..." } return } Don't allow data to be chunked if { [HTTP::version] eq "1.1" } { if { [HTTP::header is_keepalive] } { HTTP::header replace "Connection" "Keep-Alive" } if { $static::PayloadLoggerDebug or $f5_connection_debug } { log local0.debug "$log_prefix: Switching to HTTP Version 1.0." } HTTP::version "1.0" } Split out request headers and munge into string set headers [HTTP::header names] if { $static::PayloadLoggerDebug or $f5_connection_debug } { log local0.debug "$log_prefix: Request HTTP Headers = $headers" } set request_headers "'" foreach header $headers { set value [HTTP::header value $header] if { $static::PayloadLoggerDebug or $f5_connection_debug } { log local0.debug "$log_prefix: Request HTTP Header $header value = $value" } append request_headers "$header=$value " } set request_headers [string trimright $request_headers " "] append request_headers "'" } when HTTP_REQUEST_DATA { if { $static::PayloadLoggerDebug or $f5_connection_debug }{ log local0.debug "$log_prefix: Collected [HTTP::payload length] bytes."} set request_payload [HTTP::payload] } when HTTP_RESPONSE priority 50 { if { $static::PayloadLoggerDebug or $f5_connection_debug } { log local0.debug "$log_prefix: Processing HTTP_RESPONSE at priority 50..." } Skip logging if no members available if {$splunk_bypass}{ if { $static::PayloadLoggerDebug or $f5_connection_debug } { log local0.debug "$log_prefix: Splunk HSL pool is down. Bypassing logging..." } return } Split out the response headers and munge into string set headers [HTTP::header names] if { $static::PayloadLoggerDebug or $f5_connection_debug } { log local0.debug "$log_prefix: Response HTTP Headers = $headers" } set response_headers "'" foreach header $headers { set value [HTTP::header value $header] if { $static::PayloadLoggerDebug or $f5_connection_debug } { log local0.debug "$log_prefix: Response HTTP Header $header value = $value" } append response_headers "$header=$value " } set response_headers [string trimright $response_headers " "] append response_headers "'" Collect the response if { $response_length > 0 } { if { $static::PayloadLoggerDebug or $f5_connection_debug } { log local0.debug "$log_prefix: Collecting $response_length bytes from response." } HTTP::collect $response_length } Calculate actual content-length set response_length_real [HTTP::payload length] if { $static::PayloadLoggerDebug or $f5_connection_debug } { log local0.debug "$log_prefix: Real response content-length = $response_length_real." } Correct the response_length to correct value if required. if { $response_length != $response_length_real } { if { $static::PayloadLoggerDebug or $f5_connection_debug } { log local0.debug "$log_prefix: Updated \$response_length value." } set response_length $response_length_real if { $static::PayloadLoggerDebug or $f5_connection_debug } { log local0.debug "$log_prefix: New \$response_length value is $response_length." } } } when HTTP_RESPONSE_DATA { if { $static::PayloadLoggerDebug or $f5_connection_debug } { log local0.debug "$log_prefix: Processing HTTP_RESPONSE_DATA." } Gather response data set response_payload "[HTTP::payload]" } A lot of the above feeds into a larger iRule framework. E.g. we use a SplunkHTTPS iRule to actually do the HSL logging out to a syslog server. The 'HTTP::collect' is also called from that iRule aswell. However when testing this iRule, I've identified an issue whereby it appears to be breaking HTTP Keep-alive connections to some of our GF3 application servers. Removing this rule restores the keep-alive functionality. Any pointers on how I can maintain the keep-alive functionality and also be able to log the request/response data? Cheers Gavin
BigIP version 10 and logs to remote syslog server
Hi Guys, I have a bigip 3600 version 10 running. I configure the below command to send syslog to a remote serfer, yet I am not geting the logs on the syslog server. Checking the traffic on the network shows that the bigip is not sending syslog traffic. modify /sys syslog remote-servers add { SIEM { host 10.2.160.34 remote-port 514 }}
BigIP DNS Log queries
Hello We have GTM only licensed VM And we'd like to log all the queries to either the local system to remote syslog But neither ways are working Not sure if this matters but I'd like to mention that we're using GTM as cache forwarded zone, and if no domain match there then it falls to the default pool attached to the listener So back to logging, we tried two ways: local-db--publisher , but not sure where to find all queries logs?... remote hsl to to kiwi server but also there no logs been sent I simply what to see queries logs ... how should i accomplish this task?iRule to log a specific field in POST data
I'd like to have an irule log the authentication attempts for a web application I have that takes POST data. How do I pull a specific POST parameter out of the http content? Suppose I have a login page, http://example.com/loginform.html" that will have POST data for "username" and "password". So, right now, I can detect the presence of the 'username' parameter in my submitted form by looking for HTTP::method as "POST" to HTTP::uri "login-form.html" and checking that [HTTP::payload] contains "username". But I'd like to be able to generate a syslog saying "User $username attempted login from [IP::client_addr]:[TCP::client_port]" How do I best extract that "username" value from the payload data for logging without altering the actual transaction at all? Thanks!