Log Collection F5 LTM/APM

[Anonymous]

Has anyone been successful in configured an F5 LTM/APM to send logs to a log decoder?

I've followed the instructions from sadocs.emc.com but I think they are incomplete, because the F5 isn't sending any logs at all to the log decoder.

I am successfull receiving syslog to the decoder so I know it's not the decoder and I've also seen on the firewall that there is no traffic from the F5 to log decoder.

Anyone know what I'm missing?

Cheers.

[RonSmith]

I have been able to consistently send generic syslog to an F5 but it is very problematic to get any other log type.

[Anonymous]

Hello, Are these the instructions that you used? (please see below) Also, have you attempted doing a tcpdump on both ends to see, #1 is the traffic being sent, and #2 is it making it to the Decoder? Feel free to post any screenshots or error messages you are getting. Also it may be worth stopping and starting syslog on both ends as well if you haven't yet done so.

F5 Big-IP Local Traffic Manager Event Source Configuration Guide 

F5 Big-IP Advanced Firewall Manager Event Source Configuration Guide 

[Anonymous]

Do you mean to an F5 or from an F5?

I'm looking to have my F5 send logs 'to' NetWitness log decoder.

[Anonymous]

I used this guide to configure the F5 APM.I haven't used the LTM guide because we are only using the APM component, not LTM

https://community.rsa.com/docs/DOC-40146 

As I mentioned, I've looked on the firewall (which sits in between the F5 and Decoder, and the rules do allow the traffic) and there is nothing being sent from the F5.

I've performed a tcpdump on the F5 and it's not sending syslog at all.

The decoder is working fine because it can receive syslog from other sources (ie. Firewalls).

Do you know if I need to configure what interface it sends the packets from? I just assumed it would be the management interface

[Anonymous · Accepted solution]

Ok, I figured it out.

When adding in the remote syslog destination System > Logs > Configuration > Remote Logging

I needed to add the 'Local IP' address of the interface I wanted the traffic to come out of. It says "Optional" but in my case, I needed it to make it work.

Thanks for the help.

[Anonymous]

Glad you got it working!