Forum Discussion

lmwf1_55268's avatar
lmwf1_55268
Icon for Nimbostratus rankNimbostratus
Feb 18, 2009

create multiple log files for multiple web servers

How do you use irules to create multiple log files for multiple web servers?

 

For example, /var/log/ltm_web1, /var/log/ltm_web4, /var/log/ltm_web3, /var/log/ltm_web4

 

To make it a bit more fun, the log files will be on a remote unix server.

 

I have been doing a lot of researches, but not sure, and wonder if anyone has tried similar?

 

Below are what I came across. Thanks!

 

 

 

send_log_to_remote

 

when CLIENT_ACCEPTED {

 

log 10.10.1.5 local0.info "Client Connected, IP: [IP::client_addr]"

 

}

 

 

 

******************************************************

 

 

syslog include "

 

destination remote_server {

 

udp(\"10.4.0.1\" port (514));

 

udp(\"10.5.0.1\" port (514));

 

};

 

local0.* /var/log/ltm

 

filter f_local0 {

 

facility(local0) and level(debug..emerg);

 

};

 

filter f_no_audit {

 

not match(\"AUDIT\");

 

};

 

destination d_ltm {

 

file(\"/var/log/ltm\" create_dirs(yes));

 

};

 

log {

 

source(local);

 

filter(f_local0);

 

filter(f_no_audit);

 

destination(d_ltm);

 

destination(remote_server);

 

};"
application delivery
dev
devops
iRules

2 Replies

Sort By
  • hooleylist's avatar
    hooleylist
    Icon for Cirrostratus rankCirrostratus
    Feb 18, 2009
    For pre-9.4.2 you can use a config like this example:

     

     

    Separate log files per virtual/pool/node

     

    http://devcentral.f5.com/Default.aspx?tabid=53&forumid=5&tpage=1&view=topic&postid=2680026840

     

     

    For the latest versions of LTM ~9.4.2+, you have to use the bigpipe shell to configure syslog-ng. You can get more info in this article (Click here).

     

     

    Aaron
  • lmwf1_55268's avatar
    lmwf1_55268
    Icon for Nimbostratus rankNimbostratus
    Feb 18, 2009
    For v9.4.2 and newer, will this send all logs to remote server for all vips?

     

    I am still waiting for 3600 System v 9.4.5 to test this.

     

    Thanks!

     

     

     

    syslog include "

     

     

    remote server

     

    destination remote_server {

     

    udp(\"10.4.0.1\" port (514));

     

    };

     

     

    destination d_vip1 {

     

    udp(\"10.4.0.1\" port (514));

     

    };

     

     

    destination d_vip2 {

     

    udp(\"10.4.0.1\" port (514));

     

    };

     

     

    destination d_vip3{

     

    udp(\"10.4.0.1\" port (514));

     

    };

     

     

     

    local0.filters

     

    local0.* /var/log/ltm

     

    filter f_local0 {

     

    facility(local0) and level(info..emerg);

     

    };

     

     

    Filter for local0 VIP1 messages

     

    filter f_local0_vip1 {

     

    facility(local0) and level(info..emerg) and match("vip1");

     

    };

     

     

    Filter for local0 VIP2 messages

     

    filter f_local0_vip2 {

     

    facility(local0) and level(info..emerg) and match("vip2");

     

    };

     

     

    Filter for local0 VIP3 messages

     

    filter f_local0_vip3 {

     

    facility(local0) and level(info..emerg) and match("vip3");

     

    };

     

     

     

    Destinations

     

    Destination remote_server {

     

    file(\"/var/log/ltm\" create_dirs(yes));

     

    };

     

     

    LTM log file for VIP1

     

    destination d_vip1 {

     

    file(\"/var/log/ltm_vip1\" create_dirs(yes));

     

    };

     

     

    LTM log file for VIP2

     

    destination d_vip2 {

     

    file(\"/var/log/ltm_vip2\" create_dirs(yes));

     

    };

     

     

    LTM log file for VIP3

     

    destination d_vip3 {

     

    file(\"/var/log/ltm_vip3\" create_dirs(yes));

     

    };

     

     

     

     

     

    Log statements

     

    Default LTM log statement

     

    log {

     

    source(local);

     

    filter(f_local0);

     

    destination(remote_server);

     

    };

     

    VIP1 log statement

     

    log {

     

    source(local);

     

    filter(f_local0_vip1);

     

    destination(d_vip1);

     

    };

     

     

    VIP2 log statement

     

    log {

     

    source(local);

     

    filter(f_local0_vip2);

     

    destination(d_vip2);

     

    };

     

     

    VIP3 log statement

     

    log {

     

    source(local);

     

    filter(f_local0_vip3);

     

    destination(d_vip3);

     

    };