Difference between revisions of "Custom Syslog Configuration"
From Tech-Wiki
| (3 intermediate revisions by 2 users not shown) | |||
| Line 1: | Line 1: | ||
[[Category:F5 Networks]] | [[Category:F5 Networks]] | ||
| + | '''[[F5 Networks#Misc|Back to Misc]]''' | ||
| − | Using the standard method of syslog configuration on an F5 device, the device will normally send | + | Using the standard method of syslog configuration on an F5 device, the device will normally send it's syslog messages to one syslog server using the same facility and level that they were generated on the F5. |
What happens if you want to send to a different facility level on a remote host ? | What happens if you want to send to a different facility level on a remote host ? | ||
| Line 99: | Line 100: | ||
};"' | };"' | ||
| − | This configuration with the use of a priority number (The number inside <>), to replace the priority on ALL syslog messages sent out. Using the | + | This configuration with the use of a priority number (The number inside <>), to replace the priority on ALL syslog messages sent out. Using the settings above will send syslog messages at level "notice" (and below) to facility local6 on the remote server. |
This priority number can be calculated using the following formula: | This priority number can be calculated using the following formula: | ||
| Line 217: | Line 218: | ||
|Debug: debug-level messages | |Debug: debug-level messages | ||
|} | |} | ||
| − | |||
==External links== | ==External links== | ||
| − | |||
* [http://www.ietf.org/rfc/rfc3164.txt IETF - RFC3164] | * [http://www.ietf.org/rfc/rfc3164.txt IETF - RFC3164] | ||
Latest revision as of 06:57, 28 June 2017
Using the standard method of syslog configuration on an F5 device, the device will normally send it's syslog messages to one syslog server using the same facility and level that they were generated on the F5.
What happens if you want to send to a different facility level on a remote host ?
You can use the command and configuration below to achieve this.
b syslog include '"
template t_emerg {
template(\"<176>$DATE $HOST $MSGHDR$MSG\n\");
template_escape(no);
};
template t_alert {
template(\"<177>$DATE $HOST $MSGHDR$MSG\n\");
template_escape(no);
};
template t_crit {
template(\"<178>$DATE $HOST $MSGHDR$MSG\n\");
template_escape(no);
};
template t_err {
template(\"<179>$DATE $HOST $MSGHDR$MSG\n\");
template_escape(no);
};
template t_warning {
template(\"<180>$DATE $HOST $MSGHDR$MSG\n\");
template_escape(no);
};
template t_notice {
template(\"<181>$DATE $HOST $MSGHDR$MSG\n\");
template_escape(no);
};
destination remote_server_emerg {
udp(\"SYSLOG IP\" port (514) template(t_emerg));
};
destination remote_server_alert {
udp(\"SYSLOG IP\" port (514) template(t_alert));
};
destination remote_server_crit {
udp(\"SYSLOG IP\" port (514) template(t_crit));
};
destination remote_server_err {
udp(\"SYSLOG IP\" port (514) template(t_err));
};
destination remote_server_warning {
udp(\"SYSLOG IP\" port (514) template(t_warning));
};
destination remote_server_notice {
udp(\"SYSLOG IP\" port (514) template(t_notice));
};
filter f_logs_emerg {
level (emerg);
};
filter f_logs_alert {
level (alert);
};
filter f_logs_crit {
level (crit);
};
filter f_logs_err {
level (err);
};
filter f_logs_warning {
level (warning);
};
filter f_logs_notice {
level (notice);
};
log {
source(local);
filter(f_logs_emerg);
destination(remote_server_emerg);
};
log {
source(local);
filter(f_logs_alert);
destination(remote_server_alert);
};
log {
source(local);
filter(f_logs_crit);
destination(remote_server_crit);
};
log {
source(local);
filter(f_logs_err);
destination(remote_server_err);
};
log {
source(local);
filter(f_logs_warning);
destination(remote_server_warning);
};
log {
source(local);
filter(f_logs_notice);
destination(remote_server_notice);
};"'
This configuration with the use of a priority number (The number inside <>), to replace the priority on ALL syslog messages sent out. Using the settings above will send syslog messages at level "notice" (and below) to facility local6 on the remote server.
This priority number can be calculated using the following formula:
(numeric value of facility) * 8 + (numeric value of severity)
The numeric vaules are listed in the tables below.
| Numerical Code | Facility |
|---|---|
| 0 | kernel messages |
| 1 | user-level messages |
| 2 | mail system |
| 3 | system daemons |
| 4 | security/authorization messages |
| 5 | messages generated internally by syslogd |
| 6 | line printer subsystem |
| 7 | network news subsystem |
| 8 | UUCP subsystem |
| 9 | clock daemon |
| 10 | security/authorization messages |
| 11 | FTP daemon |
| 12 | NTP subsystem |
| 13 | log audit |
| 14 | log alert |
| 15 | clock daemon |
| 16 | local use 0 (local0) |
| 17 | local use 1 (local1) |
| 18 | local use 2 (local2) |
| 19 | local use 3 (local3) |
| 20 | local use 4 (local4) |
| 21 | local use 5 (local5) |
| 22 | local use 6 (local6) |
| 23 | local use 7 (local7) |
| Numerical Code | Severity |
|---|---|
| 0 | Emergency: system is unusable |
| 1 | Alert: action must be taken immediately |
| 2 | Critical: critical conditions |
| 3 | Error: error conditions |
| 4 | Warning: warning conditions |
| 5 | Notice: normal but significant condition |
| 6 | Informational: informational messages |
| 7 | Debug: debug-level messages |