we have the need to be notified when users log in and log out of the APM vpn. is this possibly? looking at the events the syslog sends now i do not see the information we need.

HI, When you say notified do you just need a log entry sent to your syslog server?

I found the default logs for apm are a bit sparse. You CAN get additional info, but at the expense of things like putting apm into debug mode. Which gets a bit too voluminous. I went the path of creating custom events from APM (Drop them in place in the VPE), which then call an iRule that logs the appropriate message. e.g. (This iRule I called log-auth-result). A better implementation would use a datagroup/class for the actual log messages when CLIENT_ACCEPTED { set larHSL [HSL::open -proto UDP -pool hsl-log-01] set larLogPrefix "<190>[virtual]:lar-1.02:[IP::client_addr]:[TCP::client_port]:" } when ACCESS_POLICY_AGENT_EVENT { set user [ACCESS::session data get "session.logon.last.username"] set method [ACCESS::session data get "session.custom.logmethod"] if { [ACCESS::policy agent_id] eq "logSuccess" } { HSL::send $larHSL "$larLogPrefix: LOGON:success $user:${method}:ssid [ACCESS::session sid]" } elseif { [ACCESS::policy agent_id] eq "logFail" } { HSL::send $larHSL "$larLogPrefix: LOGON:failed $user:${method}:" } ACCESS::session data set session.custom.virtual [virtual] ACCESS::session data set session.custom.clientip [IP::client_addr] ACCESS::session data set session.custom.clientport [TCP::client_port] ACCESS::session data set session.custom.sid [ACCESS::session sid] } when ACCESS_SESSION_CLOSED { set larHSL [HSL::open -proto UDP -pool hsl-log-01] set sessionIP [ACCESS::session data get "session.custom.clientip"] set sessionclPort [ACCESS::session data get "session.custom.clientport"] set sessionSID [ACCESS::session data get "session.custom.sid"] set sessionvirt [ACCESS::session data get "session.custom.virtual"] set larLogPrefix "<190>${sessionvirt}:lar-1.02:${sessionIP}:${sessionclPort}:" set user [ACCESS::session data get "session.logon.last.username"] HSL::send $larHSL "$larLogPrefix: LOGOF:success ${user}:ssid ${sessionSID}:" } It probably wants a trailing } else {} as well to log something when an invalid message type is passed from the VPE... But you can alter as you like. Oh, and it's session based. Not necessarily at time of network access open/close. But actual session. H

seth, yes a log entry to my syslog would be fine. issue i have seen is even in informational or debug log mode the session end is logged with only sessionID and not the users name. so by default i could only get a vpn start with sessionid and loginname, but i wouldnt get the loginname on session end because it f5 only logs sessionID on logout\session ending.

this looks like what im looking for but im not sure where in VPE i would put these? i dont see anywhere i can drop an irule for a session ending event? sorry if that doesnt make sense. thanks

Attache the iRule to the VS. Then use the iRule event object in the VPE. H

syslog APM VPN log in and log outs

16 Replies

Hamish
Cirrocumulus
Oct 31, 2013
Sounds like you're getting a TCL error... Did you check /var/log/ltm?

H
jnowlin_44976
Nimbostratus
Dec 17, 2013
so i had this all working and then i had to go to the latest version 1.4.1 HF1 for a seperate case issue. after my logging is no longer working. specifically the logout portion. i get no variable data. to simplify it i only have the following in the irule right now but i only get the message "logged out from"

when ACCESS_SESSION_CLOSED { set userclosed [ACCESS::session data get "session.logon.last.username"] set useripclosed [ACCESS::session data get "session.user.clientip"] log local0. "$userclosed logged out from $useripclosed" }

has something changed where this wont work?
DRP
Nimbostratus
Jan 15, 2016
Getting below error message when trying to attach iRule to VS. 01070151:3: Rule [/Common/VPN_Login_and_Logout] error: Unable to find pool (hsl-log-01) referenced at line 2: [HSL::open -proto UDP -pool hsl-log-01]

Can Hamish or someone please make comment on this?
Hamish
Cirrocumulus
Jan 16, 2016
The iRule uses HSL (High Speed Logging) via a pool called hsl-log-01. To use the iRule you will need a pool of servers for the HSL. Either name it that, or if you ave one already, edit the iRule to refer to your HSL pool.
DRP
Nimbostratus
Jan 19, 2016
Thank you!

Where should I see log message? I am not able to see it /var/log/ltm and /var/log/apm.

Please advice.
Hamish
Cirrocumulus
Jan 19, 2016
You'll see the logs in whichever syslog server you have listed in the HSL pool... HSL sends the logs remotely via the network... You need to have a syslog server configured somewhere that writes the logs to its own disk...

H

Forum Discussion

syslog APM VPN log in and log outs

16 Replies

Recent Discussions

Wildcard SSL Certificate Deployment on F5 LTM

iRule resulting in too many redirects

What happens if I only enable ASM in BIG-IP Under System > Resource Provisioning

URL

Migration from i series 10200 with 1 child VCMP to r series 10900 series

Related Content

Out of the Shadows: API Discovery and Security

Tcp syslog

F5 Distributed Cloud (XC) API Security in Out-of-Band Mode using BIG-IP

BIG-IP to Process TLS Syslog Traffic

LTM 9.4.2+: Custom Syslog Configuration