Forum Discussion

rjordan's avatar
rjordan
Icon for Nimbostratus rankNimbostratus
Sep 29, 2010

Syslog severity not filtered

I just configured our LTM (running 9.4.6) to send syslogs to a remote server. At this point, I don't need very granular settings, so I just used bigpipe syslog remote server . I noticed that I'm getting a lot of syslogs at the information severity level. Most of them referencing "logger" or "crond". Based on the default severity settings, I wouldn't think I would be sending information level logs. Is there something else at play here?

 

 

[root@device:Active] config b syslog list all

 

syslog {

 

partition Common

 

authpriv from notice

 

authpriv to emerg

 

cron from warning

 

cron to emerg

 

daemon from notice

 

daemon to emerg

 

include none

 

kern from notice

 

kern to emerg

 

local ip none

 

mail from notice

 

mail to emerg

 

messages from notice

 

messages to warning

 

remote port 514

 

remote server 1.2.3.4

 

userlog from notice

 

userlog to emerg

 

}

 

1 Reply

  • George_Watkins_'s avatar
    George_Watkins_
    Historic F5 Account
    Hi,

     

     

    If you'd like to filter the log levels more granularly, there is an article for custom syslog configurations here on DevCentral: http://devcentral.f5.com/Default.aspx?tabid=63&articleType=ArticleView&articleId=155

     

     

    It is slightly dated, but should work fine for 9.4.6. Hope this helps,

     

     

    -George