NimbostratusHi Folks!
I am aware of logging feature of ASM where all the application events are logged, is there any option to configure Admin and User activity logging in F5 (ASM)? If yes, how do we configure it? we would like to log all the activities carried out by admin, user, operator, guest etc and push them to Syslog server (Arcsight) for auditing purpose.
Kindly advice, on how we should go about this.
Thanks!
EmployeeHi Raghav, ASM logs system and administrative events in /var/log/asm and syslog. To send logging data to Arcsight, you need to create a logging profile and select Arcsight (Common Event Format) as the logging format. Go to Security > Event Logs > Logging Profiles, enable Application Security, enable Remote Storage, and then select your destination server.
EmployeeHi Raghav, ASM logs system and administrative events in /var/log/asm and syslog. To send logging data to Arcsight, you need to create a logging profile and select Arcsight (Common Event Format) as the logging format. Go to Security > Event Logs > Logging Profiles, enable Application Security, enable Remote Storage, and then select your destination server.
EmployeeHi Raghav, currently we can only log security-related events to a remote destination.