NimbostratusCan HSL be used to replace remote syslog v11.x
This is for a v11.2.0 LTM/APM box.
I have an HSL logging iRule on a test box that work great for HTTP request/response. I also have remote logging setup to a remote syslog server as well as 'Write To APM Log File' enabled with the level set to 'informational' so we can log the session variables.
Here is the config:
[root@device:Active] log tmsh list /sys syslog
sys syslog {
remote-servers {
remotesyslog1 {
host 10.1.1.1
remote-port 514
}
}
}
[root@device:Active] log tmsh list /sys db "log.access.syslog"
sys db log.access.syslog {
value "enable"
}
[root@device:Active] log tmsh list /sys db "log.accesscontrol.level"
sys db log.accesscontrol.level {
value "Informational"
}
[root@device:Active] log
As detailed in the release notes of 11.2 and in SOL11124 this type of logging can potentially cause issues:
"When running performance tests or under very high traffic loads, the /var/log/apm log file can grow to a very large size. Under these conditions, it is advised to disable logging to /var/log/apm/."
This is where I am hoping that a HSL iRule could be used to replace everything that is logged to /var/log/apm. Therefore we could still log the same data to a remote server without the possiblity of an impact to the production box.
I started to craft an iRule but I cannot see to get everything that is listed in /var/log/apm. Any one else have success in this type of iRule or is there an easy way to have /var/log/apm logged via HSL?
