NimbostratusWe are already logging to remote log server arcsight but we see only for one day in the arcsight ? how do i extend that ?
CirrocumulusClearly the problem is in your ArcSight and not in F5. If you are seeing logs in ArcSight the log data has already left the F5 and is stored on ArcSight. If you can't see more than one day's worth of logs in ArcSight you either have a data retention period set to 1 day in ArcSight (which is really bad) or using a filter in ArcSight to show you only the last 24 hours of logs (which is more likely).