I was looking into this aswell about a year ago, and my findings were the same as crodriguez mentiones. There does not seem to be any "native" support in just LTM for ArcSight and CEF output.
It is possible to send CEF formatted logs over HSL, but you have to manually create the output format to be correct CEF.
Some useful links I found for formatting the logs as CEF.
ArcSight Common Event Format (CEF) Guide
Apache Access Log in CEF
System Logging: Log Messages Format for your SIEM - RFC 3164 or CEF?
Also, have a look at this for available parameters
Overview: Configuring a Request Logging profile
To send CEF from a request profile this is what we use
Request settings / Template:
$DATE_MON $DATE_DD $TIME_HMS $BIGIP_HOSTNAME CEF:0|F5|BIG-IP|||HTTP Request|Low| src=$CLIENT_IP spt=$CLIENT_PORT dst=$SERVER_IP dpt=$SERVER_PORT requestMethod=$HTTP_METHOD request=$HTTP_URI requestClientApplication=${User-agent}
Response settings / Template:
$DATE_MON $DATE_DD $TIME_HMS $BIGIP_HOSTNAME CEF:0|F5|BIG-IP||$HTTP_METHOD:$HTTP_STATCODE|HTTP Response|Low| src=$CLIENT_IP spt=$CLIENT_PORT dst=$SERVER_IP dpt=$SERVER_PORT deviceSeverity=$HTTP_STATCODE requestMethod=$HTTP_METHOD request=$HTTP_URI requestClientApplication=${User-agent} in=${Content-Length} out=$RESPONSE_SIZE sourceTranslatedAddress=$SNAT_IP sourceTranslatedPort=$SNAT_PORT requestUrlQuery=$HTTP_QUERY cs2=$RESPONSE_MSECS cs2Label=time-taken
Config
ltm pool arcsight_log_pool {
members {
connector1.company.com:514 {
address 10.10.10.10
}
}
}
ltm profile request-log COMPANY_request_logging_profile {
app-service none
defaults-from /Common/request-log
log-response-by-default yes
request-log-pool /Common/arcsight_log_pool
request-log-protocol mds-udp
request-log-template "$DATE_MON $DATE_DD $TIME_HMS $BIGIP_HOSTNAME CEF:0|F5|BIG-IP|||HTTP Request|Low| src=$CLIENT_IP spt=$CLIENT_PORT dst=$SERVER_IP dpt=$SERVER_PORT requestMethod=$HTTP_METHOD request=$HTTP_URI requestClientApplication=${User-agent}"
request-logging enabled
response-log-pool /Common/arcsight_log_pool
response-log-protocol mds-udp
response-log-template "$DATE_MON $DATE_DD $TIME_HMS $BIGIP_HOSTNAME CEF:0|F5|BIG-IP||$HTTP_METHOD:$HTTP_STATCODE|HTTP Response|Low| src=$CLIENT_IP spt=$CLIENT_PORT dst=$SERVER_IP dpt=$SERVER_PORT deviceSeverity=$HTTP_STATCODE requestMethod=$HTTP_METHOD request=$HTTP_URI requestClientApplication=${User-agent} in=${Content-Length} out=$RESPONSE_SIZE sourceTranslatedAddress=$SNAT_IP sourceTranslatedPort=$SNAT_PORT requestUrlQuery=$HTTP_QUERY cs2=$RESPONSE_MSECS cs2Label=time-taken"
response-logging enabled
}
This post has an example of using an irule and remote logging to send CEF.
Measuring Response time based on POST and GET Parameters
/Andreas
Nimbostratus
