Forum Discussion
nitass
Jul 04, 2012Employee
this is my testing.
LTM 9.4.2+: Custom Syslog Configuration by Deb
https://devcentral.f5.com/s/articles/LTM-9-4-2-Custom-Syslog-Configuration
[root@ve10:Active] config b syslog include
SYSLOG - Include Data: none
[root@ve10:Active] config b syslog include '"
> destination remote_server {
> udp(\"192.168.206.55\" port (514));
> };
> filter f_rule {
> match(\"_rule\");
> };
> log {
> source(s_syslog_pipe);
> filter(f_local0);
> filter(f_rule);
> destination(remote_server);
> };"'
[root@ve10:Active] config b syslog include
SYSLOG - Include Data:
destination remote_server {
udp("192.168.206.55" port (514));
};
filter f_rule {
match("_rule");
};
log {
source(s_syslog_pipe);
filter(f_local0);
filter(f_rule);
destination(remote_server);
};
[root@ve10:Active] config b rule test_rule list
rule test_rule {
when CLIENT_ACCEPTED {
set test "HTTP::uri"
eval $test
}
/var/log/ltm
Jul 4 12:43:03 local/tmm err tmm[5111]: 01220001:3: TCL error: test_rule - Operation not supported (line 2) invoked from within "HTTP::uri" ("eval" body line 1) invoked from within "eval $test"
syslog
C:\>nc -l -u -p 514
<131>Jul 4 12:43:03 local/tmm err tmm[5111]: 01220001:3: TCL error: test_rule - Operation not supported (line 2) invoked from within "HTTP::uri" ("eval" body line 1) invoked from within "eval $test"