Forum Discussion

Tapan_90342's avatar
Tapan_90342
Icon for Nimbostratus rankNimbostratus
May 28, 2008

HTTP and HTTPS Requests logging in Apache Style

Hi

 

We are evaluating BIG-IP 9.3.1 Build 37.1 series 3400 as apache replacement.

 

The above version info I took from configuration utility -> System -> General properties page

 

 

 

We generate apache access logs and they are useful for our application.

 

 

Since we will have significant amount of logs, we do not want to write to ltm logs (default).

 

F5 support guy who helped with initial installation suggested that we write an iRule and configure a remote syslog server to collect logs.

 

 

I searched on the wiki and found this

 

http://devcentral.f5.com/Default.aspx?tabid=63&articleType=ArticleView&articleId=190

 

It suggests "In LTM 9.4.0, the log command was enhanced to provide the ability to send messages to a remote server."

 

So does this mean my version 9.3.1 does not support remote logging?

 

 

It looks to me that remote logging is not supported on 9.3.1 because when I try to create iRule based on link http://devcentral.f5.com/wiki/default.aspx/iRules/Custom_Apache_style_logging_for_Java_based_applications.html

 

by replacing line

 

log local0. "$request_log_line,\

 

with

 

log 192.168.xx.xxx local0. "$request_log_line,\

 

OR

 

log -noname 192.168.xx.xxx local0. "$request_log_line,\

 

I get error message "line 20: [wrong args] "

 

 

My problem is how can I generate logs similar to apache on a remote server?

 

Is it possible at all using 9.3.1 or shall we get a firmware upgrade?

 

 

2 Replies

  • As you found, the log format for logging directly from an iRule to a remote syslog server was only introduced in 9.4. so you can't use the log statement in an iRule with a remote syslog server in versions prior to 9.4.

     

     

    If the UDP-based traffic is working, the routing should be okay. Do you see any errors in /var/log/messages when using TCP? Does syslog-ng start correctly (bigstart status syslog-ng)?

     

     

    Aaron
  • I had forgot to restart the remote syslog server :-p I got the log infrastructure up today. Will configure it now!

     

    Thanks for the support