Forum Discussion

mdiamore's avatar
mdiamore
Icon for Nimbostratus rankNimbostratus
May 06, 2020

Logging Facilities Missing in /sys syslog all-properties

Can some explain the limitations on the available logging facilities via the edit /sys syslog all-properties command?

 

This question stems from an issue I'm having with HSL/Splunk log offload configuration. In the past, configuration via the more basic "remote servers" component was able to offload items from /var/log/ltm such as TCP Resets (if configured via /sys db tcpreset.log value) and SSL Handshake failures.

However, since transitioning to include destination d_remote_loghost {target IP/ports} and a basic HTTP request iRule, I am unable to see any of these messages.

 

One would think that local0-5 (and local7) would be available for offload configuration but clearly a syntax error is returned.

 

What am I missing / interpreting wrong in the configuration instructions to both A) get more in-depth /var/log/ltm content, and B) have it successfully offload to Splunk?

No RepliesBe the first to reply