Forum Discussion

JCaine's avatar
JCaine
Icon for Altocumulus rankAltocumulus
Apr 03, 2020

New VS creation identification in Logs

Hello folks,

 

I a new to F5 technologies. For an audit purpose, I would like to identify, through logs (LTM I guess), new VS creations and the subject (user) who performed it.

I still can't find something clear about that.

Any clue?

 

Thank you.

  • Hello JCaine,

     

    Check audit log in /var/log/audit

    https://support.f5.com/csp/article/K5532

     

    About audit logging

    Audit logging is an optional feature that logs messages whenever a BIG-IP® system object, such as a virtual server or a load balancing pool, is configured (that is, created, modified, or deleted). The BIG-IP system logs the messages for these auditing events in the file /var/log/audit.

    There are three ways that objects can be configured:

    • By user action
    • By system action
    • By loading configuration data

    Whenever an object is configured in one of these ways, the BIG-IP system logs a message to the audit log.

     

  • Hello JCaine,

     

    Check audit log in /var/log/audit

    https://support.f5.com/csp/article/K5532

     

    About audit logging

    Audit logging is an optional feature that logs messages whenever a BIG-IP® system object, such as a virtual server or a load balancing pool, is configured (that is, created, modified, or deleted). The BIG-IP system logs the messages for these auditing events in the file /var/log/audit.

    There are three ways that objects can be configured:

    • By user action
    • By system action
    • By loading configuration data

    Whenever an object is configured in one of these ways, the BIG-IP system logs a message to the audit log.

     

  • Hello  

     

    Thanks for your quick reply. At first glance, it seems to fit.

     

    Kind regards