Security Event logs - local locations

Question

This seems like a really stupid question to have to ask, but I can't seem to find an answer in the documentation.&nbsp;
I am running Big-IP 11.5 with AFM provisioned. I am running a Security Network Firewall rule (global) with logging enabled.&nbsp;
For various reasons I want to look at the local log file on the Big-IP from the command line, but can not locate them. &nbsp;
Where are the Network Firewall logs located? If the different contexts have logs in different locations, I'd appreciate knowing where the firewall logs are for Global, Virtual Servers and Self-IP.&nbsp;
Thanks&nbsp;

what_lies_bene1 · Answer

It seems you have to specifically configure logging, no doubt because the logs could be considerable. See here for full details: http://support.f5.com/kb/en-us/products/big-ip-afm/manuals/product/network-firewall-policies-implementations-11-3-0/6.html.&nbsp;
It seems logging can only be applied per virtual server.&nbsp;

mike_rootvik_15 · Answer

Thanks for the response. As indicated in the original post, I do have logging enabled (it is using the local-db-publisher) and configured to log Network Firewall events. Which I can sucessfully view via the GUI.&nbsp;
What I am having issues with, is locating where these log entries are stored on Big-IP system, and how I can view them from the CLI.&nbsp;

what_lies_bene1 · Answer

Ahhh, I see, sorry. I see if I can find out, will probably be tomorrow.

what_lies_bene1 · Answer

So, I've had a bit of a play. I think you'll find local syslog entries here: /shared/avr_afm.&nbsp;
However, unless you configure the local-db-publisher to also use the local syslog facility I doubt you'll see anything. You can configure this under System &gt; Logs &gt; Configuration &gt; Log Publishers.&nbsp;
Let me know if this helps.&nbsp;

mike_rootvik_15 · Answer

After crawling around the Big-IP for a while I discovered that the AFM rule loggin is written into the LTM log in /var/log/.&nbsp;
At least when loggin was configured to use the local-db-publisher.&nbsp;

Forum Discussion

Security Event logs - local locations

10 Replies

Recent Discussions

Overwriting or adding LTM SSL Traffic cert and key using iControlREST

F5 Access Guard Deprecated: ZTA APM

F5 loadbalancer not working

Pricing when used with aws waf

F5 terminal - help to run commands - disk space full

Related Content

Security Automation with F5 BIG-IP and Event Driven Ansible

Security event logs forwarding

Using ChatGPT for security and introduction of AI security

BIG-IQ RestAPI - retrieve customized Web Application Security Event Log

ChatGPT and security - This Week in Security Feb 18th to Feb 25th, 2023