Forum Discussion

igor_'s avatar
igor_
Icon for Altocumulus rankAltocumulus
Jul 19, 2023
Solved

F5 remote logging server

Hi all, I have configured F5 to use a remote log server which is in a different subnet range. Nothing is going into it from F5. Are there some other things that have to be enabled also? The remote ...
devops
  • igor_'s avatar
    igor_
    Jul 27, 2023

     Hi,

    We managed to solve the problem by configuring Logging Profile in Security >> Event Logs: Logging Profiles and assigning it to a VS.

    We had to set the Logging Format to CSV, which is a headache for Graylog since you have to create extractors for different field types.

     

whisperer's avatar
whisperer
Icon for MVP rankMVP
Jul 20, 2023

Your syslog server can be anywhere. The F5 needs to know how to get there! For syslog traffic, originating from the F5 BIG-IP you can use the MGMT port but if you want to use High Speed Logging (HSL) it would be advantageous to use a TMM port. To accomplish these things, you need to add routes. So the F5 knows where to send the traffic. Then of course you need to make sure your network has the correct permissions (firewall policies) and routes as well.