NimbostratusI'm trying to setup my Big IP v12.1.1 to send the LTM logs (/var/log/ltm) to a remote arcsight server using the CEF format.
I've got it setup to send security logs to the remote server using the CEF format, but cannot figure out how to send the LTM logs.
Any ideas on where to start?
Nimbostratusyou need to use it as HSL https://support.f5.com/kb/en-us/products/big-ip_ltm/manuals/product/bigip-external-monitoring-implementations-11-3-0/2.html and than you have log filter, you can choose what to forward to the logger
NimbostratusThis article is stated to apply to version 11.3...i'm assuming there will be no change when working with v12.1.1?
Nimbostratusi am with 12.1.1 same working same way
NimbostratusTry this one: Manual Chapter: Configuring Remote High-Speed Logging
If the only module you have provisioned is LTM, then you will need to look at using an iRule to do HSL Logging.
Intermediate iRules: High Speed Logging - Spray Those Log Statements!