NXLog User Guide

Connect via SSH to the BIG-IP device. In case of a High Availability (HA) group, make sure you are logged into the active unit. You should see (Active) in command prompt.

Configure a remote Syslog destination on BIG-IP. Replace IP_SYSLOG and PORT with the IP address and port that the NXLog agent is listening on.

# tmsh modify sys syslog remote-servers add { nxlog { \
  host IP_SYSLOG remote-port PORT } }

# tmsh modify sys syslog remote-servers add { nxlog { \
  host 192.168.6.143 remote-port 514 } }

In case of a High Availability (HA) group, synchronize configuration changes to the other units:

# tmsh run cm config-sync to-group GROUP_NAME

Log in to the BIG-IP web interface. In case of a High Availability (HA) group, make sure you are logged into the active unit. You should see ONLINE (Active) in the top left corner.

Go to System › Logs › Configuration › Remote Logging.

Type in the Remote IP and Remote Port, then click Add and Update.

In case of a High Availability (HA) group, synchronize the configuration changes to the other units:

Connect via SSH to the BIG-IP device. In case of a High Availability (HA) group, make sure you are logged into the active unit. You should see (Active) in the command prompt.

Enable the pre-defined default traps as required.

# tmsh modify sys snmp bigip-traps enabled
# tmsh modify sys snmp agent-trap enabled
# tmsh modify sys snmp auth-trap enabled

Create an SNMP user (SNMPv3 only).

# tmsh modify sys snmp users add { \
  USERNAME { \
  username USERNAME \
  auth-protocol sha \
  privacy-protocol aes \
  auth-password **** \
  privacy-password **** } }

# tmsh modify sys snmp users add { \
  snmpv3_user { \
  username snmpv3_user \
  auth-protocol md5 \
  privacy-protocol aes \
  auth-password q1w2e3r4 \
  privacy-password q1w2e3r4 } }

Configure the remote SNMP destination on BIG-IP. Replace NAME, COMMUNITY, IP_ADDRESS, and PORT with appropriate values. Replace NETWORK with other unless traps are going out the management interface, when management should be specified instead.

# tmsh modify sys snmp traps add { NAME { community COMMUNITY \
  host IP_ADDRESS port PORT network NETWORK }

# tmsh modify sys snmp traps add { 192_168_6_143 { community nxlog \
  host 192.168.6.143 port 162 network other }

# tmsh modify sys snmp traps add { nxlog { \
  version 3 \
  host 192.168.6.143 \
  port 162 \
  network other \
  security-level auth-privacy \
  security-name snmp_user \
  auth-protocol sha \
  auth-password q1w2e3r4 \
  privacy-protocol aes \
  privacy-password q1w2e3r4 } }

In case of a High Availability (HA) group, synchronize the configuration changes to the other units.

# tmsh run cm config-sync to-group GROUP_NAME

Log in to the BIG-IP web interface. In case of a High Availability (HA) group, make sure you are logged into the active unit. You should see ONLINE (Active) in the top left corner.

Go to System › SNMP › Traps. Select the required SNMP events and click Update.

Create an SNMP user (SNMPv3 only). Go to System › SNMP › Agent › Access (v3). Click Create and specify the user name, authentication type and password, privacy protocol and password, and access type. Specify an OID value to limit access to certain OIDs, or use .1 to allow full access.

Go to System › SNMP › Traps › Destination and click Create. Specify the SNMP version, community name, destination IP address, destination port, and network to send traffic to. Then click Finished.

In case of a High Availability (HA) group, synchronize the configuration changes to the other units.

Log in to BIG-IP via SSH.

Create a remote logging destination. Replace NAME with a name for the destination, POOL with the name used above when creating the pool, DISTRIBUTION with one of the distribution options shown below, and PROTOCOL with tcp or udp. Distribution options include:

# tmsh create sys log-config destination remote-high-speed-log NAME \
  pool-name POOL distribution DISTRIBUTION protocol PROTOCOL

Create a log publisher. Replace NAME with a name for the publisher and DESTINATION with the destination name used in the previous step.

# tmsh create sys log-config publisher NAME destinations add {DESTINATION}

Create a log filter. Replace NAME with a name for the filter, LEVEL with the required logging level between Emergency and Debugging, PUBLISHER with the name used in the previous step, and SOURCE with a particular process running on BIG-IP (or all, which sends all logs).

# tmsh create sys log-config filter NAME level LEVEL \
  publisher PUBLISHER source SOURCE

Configure NXLog (see the examples below), then restart NXLog.

Create a request logging profile. In most cases it is enough to log only requests, however if required the same profile can be configured to log responses and logging errors. Replace NAME with a name for the profile, PROTOCOL with mds-tcp or mds-udp, POOL with the pool name, and TEMPLATE with a list of HTTP request fields that will be logged (see the LTM implementation guide).

# tmsh create ltm profile request-log NAME { \
  request-log-protocol PROTOCOL request-log-pool POOL request-logging enabled \
  request-log-template "TEMPLATE" }

Assign the logging profile to a virtual server. Replace NAME with the virtual server name and LOGGING_PROFILE with the profile name used in the previous step. A logging profile can be assigned to multiple virtual servers.

# tmsh modify ltm virtual NAME {profiles add {LOGGING_PROFILE {}}}

# tmsh create ltm profile request-log traffic-to-nxlog { \
  request-log-protocol mds-tcp request-log-pool nxlog request-logging enabled \
  request-log-template "client $CLIENT_IP:$CLIENT_PORT request $HTTP_REQUEST \
  server $SERVER_IP:$SERVER_PORT status $HTTP_STATUS" }
# tmsh modify ltm virtual q-web-farm-HTTPS {profiles add {traffic-to-nxlog {}}}