Learn F5 Technologies, Get Answers & Share Community Solutions Join DevCentral

Filter by:
  • Solution
  • Technology
Answers

LTM 9.4.2+ Custom Syslog errors when bpsh used

Followed information in the article LTM 9.4.2+: Custom Syslog configuration to have logs go to my syslog server.

Followed the process of creating a file and then using bpsh.
but when i do I end up with errors. What am I doing wrong here??
It should be simple to send a class of messages to an external logging host.
Thanks.


file is to send local0 LTM messages. the file contents and console shows:

[bhhanson@f5ndcint1b:Standby] ~ # cat syslog-skinner.inc
syslog include "
destination remote_server {
udp(\"172.17.1.1\" port (514)sy);
};

# local0.*/var/log/ltm
filter f_local0 {
facility(local0);
};

filter f_no_audit {
not match(\"AUDIT\");
};

destination d_ltm {
file(\"/var/log/ltm\" create_dirs(yes));
};

log {
source(local);
filter(f_local0);
filter(f_no_audit);
destination(d_ltm);
destionation(remote_server);
};"
[bhhanson@f5ndcint1b:Standby] ~ #
[bhhanson@f5ndcint1b:Standby] ~ # bpsh < syslog-skinner.inc
BIGpipe unknown operation error:
01070920:3: Application error for confpp: STDERR/STDOUT text begins
Stopping syslog-ng: [ OK ]
Starting syslog-ng: \\Warning: Unknown facility; facility='s_httpd'
Warning: Unknown facility; facility='s_httpd'
Warning: Unknown facility; facility='s_httpd'
Warning: Unknown facility; facility='s_httpd'
syntax error at 515
[FAILED]
STDERR/STDOUT text ends
*************************************************************
Oct 27 12:56:42 f5ndcint1b.healthpartners.com confpp[7267]: reconfig command FAILURE for unix_config_syslog returned:
'/etc/init.d/syslog-ng restart 2>&1'
Stopping syslog-ng: [FAILED]
Starting syslog-ng: [ OK ]


[bhhanson@f5ndcint1b:Standby] ~ #
0
Rate this Question

Answers to this Question

placeholder+image
USER ACCEPTED ANSWER & F5 ACCEPTED ANSWER
I'm not sure what the error about s_httpd is. Do you have a facility set to an invalid name?

Also, it looks like there is a typo in destination:

destionation(remote_server);

This line also looks incorrect:

udp(\"172.17.1.1\" port (514)sy);

Aaron
0
placeholder+image
USER ACCEPTED ANSWER & F5 ACCEPTED ANSWER
gosh. *embarassed* the 'sy' was not supposed to be there. bad paste/edit. i think destination does not have an 'o' in it.

right.. this is 'out of the box' and the first time I have tried to use this process. So where does this all mess up.
maybe time to ask support?
0
placeholder+image
USER ACCEPTED ANSWER & F5 ACCEPTED ANSWER
If you're following the steps in the article and they're not working, F5 Support should be able to help troubleshoot the issue.

Aaron
0