Forum Discussion
Hi JD,
First thing I want to point out is that you should not run your device with Debug logging turned on in production. Debug logging is very verbose and will affect performance. Debug logging is designed for support/development to troubleshoot issues not for normal log level.
Not sure if you need HSL... I assume that ArcSight can be setup to listen on UDP 514 for syslog traffic? If so just point the F5 to remote log. Under "System > Logs > Configuration > Remote Logging" just add your IP address of the syslog server. The log entries will be sent in standard syslog format which ArcSight should be able to consume.
If you do it this way then all the logs will be shipped off and you don't have to worry about setting up HSL.
Regards,
Seth