Forum Discussion

Songseajoon_222's avatar
Songseajoon_222
Icon for Nimbostratus rankNimbostratus
Apr 07, 2016

Only those taken in the / var / log / apm can I send to syslog?

Hello,

 

I can now use the Big-IP 11.5.3, and operate the APM.

 

As customer's request, only logs taken in / var / log / apm want to send to syslog.

 

I was now haedu specify the IP address and Port to log >> configuration >> remote logging,

 

pool also add is registered with VS.

 

And I made an iRule,

 

when CLIENT_ACCEPTED { set ClientIP [IP::client_addr] }

 

when ACCESS_POLICY_AGENT_EVENT { switch [ACCESS::policy agent_id] { "IP_Assign" { set hsl [HSL::open -proto UDP -pool syslog_pool1] set id [ACCESS::session data get session.logon.last.username] set Assign [ACCESS::session data get session.custom.id] log local0. "F5 Network clientIP= '$ClientIP' User= '$id' Assign_IP = '$Assign' Assign ACL Assign Split" HSL::send $hsl "F5 Network clientIP= '$ClientIP' User= '$id' Assign_IP = '$Assign' Assign ACL Assign Split" } } }

 

 

But there is a problem.

 

Continuously stamped with a health check and logs are similar,

 

 

The logs are taken to the menu, such as when you move various BIG-IP UI.

 

How can I do this?

 

I wish only the APM log jjikhyeot.

 

For example, like shown in the Access Policy >> Reports.