Learn F5 Technologies, Get Answers & Share Community Solutions Join DevCentral

Filter by:
  • Solution
  • Technology
Answers

Syslog locally and remote with specific facility level

Hi,

Hopefully i am posting this in the correct forum, and apologies if this is not, or if this question has been asked before. I did look around before posting but couldnt really see an answer.

I want to change the syslog config on the LTM (running version 9.4.6) to log locally, but also remotely, however when the syslogs are sent to the remote syslog server they need to be all at a the same facility level (level yet to be determined), but i dont want to mess with the local logs.

This is because the remote syslog server is a central server receiving logs from hundreds of devices, it filters these into deifferent directories and files dependant on the facility level.

Is this possible and could anyone offer some advice how to achieve this ?

Many thanks in advance
0
Rate this Question

Answers to this Question

placeholder+image
USER ACCEPTED ANSWER & F5 ACCEPTED ANSWER
You might be able to do something using templates in syslog-ng. The only F5-specific part of the config is how you enter the syslog-ng configuration. You can do this using the bpsh following the examples in this article from Deb:

syslog-ng rewrite facility destination (Click here)

http://www.campin.net/syslog-ng/faq.html#template
https://lists.balabit.hu/pipermail/syslog-ng/2001-January/001153.html

LTM 9.4.2+: Custom Syslog Configuration
http://devcentral.f5.com/Default.aspx?tabid=63&articleType=ArticleView&articleId=155

And here are a few related posts:

How to filter syslog messages
http://devcentral.f5.com/Default.aspx?tabid=53&forumid=31&tpage=1&view=topic&postid=62132

syslog-ng filter not working
http://devcentral.f5.com/Default.aspx?tabid=53&forumid=5&tpage=1&view=topic&postid=56442

Aaron
0
Comments on this Answer
Comment made 23-Feb-2015 by dirtiPACKET 349
hoolio... I realize this article is over 5 years old but is there an update to this using 11.x?
1
Comment made 11-May-2016 by Hem 198
Is there an update for 12.x
0