Difference between revisions of "Custom Syslog Configuration"

Revision as of 02:24, 8 August 2016

Using the standard method of syslog configuration on an F5 device, the device will normally send it's syslog messages to one syslog server using the same facility and level that they were generated on the F5.

What happens if you want to send to a different facility level on a remote host ?

You can use the command and configuration below to achieve this.

b syslog include '"
template t_emerg {
template(\"<176>$DATE $HOST $MSGHDR$MSG\n\");
template_escape(no);
};
template t_alert {
template(\"<177>$DATE $HOST $MSGHDR$MSG\n\");
template_escape(no);
};
template t_crit {
template(\"<178>$DATE $HOST $MSGHDR$MSG\n\");
template_escape(no);
};
template t_err {
template(\"<179>$DATE $HOST $MSGHDR$MSG\n\");
template_escape(no);
};
template t_warning {
template(\"<180>$DATE $HOST $MSGHDR$MSG\n\");
template_escape(no);
};
template t_notice {
template(\"<181>$DATE $HOST $MSGHDR$MSG\n\");
template_escape(no);
};
destination remote_server_emerg {
udp(\"SYSLOG IP\" port (514) template(t_emerg));
};
destination remote_server_alert {
udp(\"SYSLOG IP\" port (514) template(t_alert));
};
destination remote_server_crit {
udp(\"SYSLOG IP\" port (514) template(t_crit));
};
destination remote_server_err {
udp(\"SYSLOG IP\" port (514) template(t_err));
};
destination remote_server_warning {
udp(\"SYSLOG IP\" port (514) template(t_warning));
};
destination remote_server_notice {
udp(\"SYSLOG IP\" port (514) template(t_notice));
};
filter f_logs_emerg {
level (emerg);
};
filter f_logs_alert {
level (alert);
};
filter f_logs_crit {
level (crit);
};
filter f_logs_err {
level (err);
};
filter f_logs_warning {
level (warning);
};
filter f_logs_notice {
level (notice);
};
log {
source(local);
filter(f_logs_emerg);
destination(remote_server_emerg);
};
log {
source(local);
filter(f_logs_alert);
destination(remote_server_alert);
};
log {
source(local);
filter(f_logs_crit);
destination(remote_server_crit);
};
log {
source(local);
filter(f_logs_err);
destination(remote_server_err);
};
log {
source(local);
filter(f_logs_warning);
destination(remote_server_warning);
};
log {
source(local);
filter(f_logs_notice);
destination(remote_server_notice);
};"'

This configuration with the use of a priority number (The number inside <>), to replace the priority on ALL syslog messages sent out. Using the settings above will send syslog messages at level "notice" (and below) to facility local6 on the remote server.

This priority number can be calculated using the following formula:

(numeric value of facility) * 8 + (numeric value of severity)

The numeric vaules are listed in the tables below.

External links

• IETF - RFC3164