Forum Discussion

Santavi_241428's avatar
Santavi_241428
Icon for Nimbostratus rankNimbostratus
Jan 03, 2016

need help for splunk

Hi Team,

 

Currently we are facing some issues regarding the following scenario.

 

Customer has given the requirement as follows:

 

9 VIPs to be created to load balance syslog traffic (UDP 514). The pool members are listening on UDP and TCP. UDP will be used to receive syslog traffic, and TCP will be used for the load balancer to monitor the pool member. In the event a pool member stops responding on the appropriate TCP port that pool member must be marked down.

 

example of one vip:

 

VIP1

Name: VS_abcd_ids_udp514 Address: w.x.y.z Mask: 255.255.255.255 Service Port: UDP 514 SNAT Pool: None Profile: UDP

 

Pool

Name: Pool_abcd_ids_2514 Member1: w.x.y.z:2514 Member2: w.x.y.z:2514

 

Monitor TCP 2514

After implementation we observed as foolws:

 

At first we observed as follows: Response on splunk server user was seeing as it is coming from F5 self ips. The message is something like this F5 "self ip:default send string". After another test requestor told he is not seeing the message.However he wants to see 2 things on his splunk server.

 

1.The source ips from where the logs are coming 2.He wants to see the real pool member ips instead of load balancer self ips.

 

I did not get time to capture the traffic. But worrying why requestor did not see the same message ""self ip:default send string" twice?

 

Why the self ips are showing on splunk server instead virtual server ips at least?

 

The health monitor i put as UDP instead of TCP since TCP requires a string and user was not sure what to share for same..Although UDP seems ok since servers were showing up....Let me know any consideration here pls.

 

How can I make the configurations so users can see the source ips from where the logs are coming and also the pool members on splunk..

 

Can anyone please help with this.....Thanks in advance and happy new year............................

 

application delivery
BIG-IP
LTM

2 Replies

Sort By
  • boneyard's avatar
    boneyard
    Icon for MVP rankMVP
    Jan 03, 2016

    i think what you are seeing is the health monitor traffic reaching splunk. if you don't want that you might be find with a simple TCP monitor without sending any data. in this case i don't believe syslog sends a reponse for correct requests so sending anything is not really useful anyway.

     

    did you see anything then "self ip:default send string" on splunk? because in that case your virtual server / pool might not be correctly setup or traffic might be unable to reach your splunk servers.

     

  • Santavi_241428's avatar
    Santavi_241428
    Icon for Nimbostratus rankNimbostratus
    Jan 18, 2016

    may be my previous question was big and and confusing...The requirement is like this:

     

    • there will be many different devices, will communicate to the load balancer on device-specific VIPs. Please go through the attached diagram for better understanding
    • The log message on splunk must retain the client source IP from where the logs are coming instead of virtual ips of load balancers.
    • Disabling snat did not solve the purpose.

    Can anybody help please?