Configuring Remote Syslog for F5 BIG-IP LTM V11.x to V14.x

You can configure syslog for F5 BIG-IP LTM 11.x to V14.x.

About this task

To configure syslog for F5 BIG-IP LTM V11.x to V14.x take the following steps:

Procedure

  1. Log in to the command-line of your F5 BIG-IP device.
  2. To log in to the Traffic Management Shell (tmsh), type the following command:

    tmsh

  3. To add a syslog server, type the following command:

    modify /sys syslog remote-servers add {<Name> {host <IP address> remote-port 514}}

    Where:

    • <Name> is a name that you assign to identify the syslog server on your BIG-IP LTM appliance.
    • <IP address> is the IP address of IBM QRadar.
    For example,

    modify /sys syslog remote-servers add {BIGIPsyslog {host 192.0.2.1 remote-port 514}}

  4. Save the configuration changes:

    save /sys config

    Events that are forwarded from your F5 Networks BIG-IP LTM appliance are displayed on the Log Activity tab in QRadar.