CirrusI´m sending syslog to OMS Loganalytics from Bigip to monitoring our bigip´s. What syslog messages are "important" that I should create alerts on? * Pool member down ? * Health of Bigip?
AltostratusWe usually configure the alerts for both the pool and the nodes. Below articles can help you how to configure those alerts.
https://support.f5.com/csp/article/K13180
https://support.f5.com/csp/article/K3727
NimbostratusWould you share how you are sending the logs to OMS?
CirrusJeff: We got a syslog-nx server on a linux VM. It´s collecting all logs from bigip. The syslog server got an OMS Log Analytics agent. Our logs are are received as Type=Syslog, but I have seen that it´s possible to use CEF with Cisco ASA. Probably possible to send CEF logs from Bigip to OMS and integrated this with Azure Security Center.
Another option is that probably could work is doing https post directly from irule´s to OMS server without a syslog server.