Forum Discussion

seilemor's avatar
seilemor
Icon for Nimbostratus rankNimbostratus
Aug 23, 2019

System authentication logging

Hi, for some SIEM scenarios I need to have the BigIP login events within our remote log management. Within the GUI I can see the following event if an login failed: Fri Aug 23 09:51:59 CEST 2019 ...
event logging
high speed logging
LTM
Andrew-F5's avatar
Andrew-F5
Icon for Employee rankEmployee
Sep 04, 2019

HSL doesn't log events related to management, only system-level events.

K15521451: BIG-IP TMOS operations guide | Chapter 12: Log files and alerts

HSL mechanism can log BIG-IP system-level events, DNS events (for local traffic and global traffic) , Network Firewall events, and Protocol Security Manager events, carrier-grade NAT (CGNAT) events, and distributed denial of service (DDoS) protection events.

Here's a similar DevCentral thread that may be of use, https://devcentral.f5.com/s/question/0D51T00006i7XrlSAE/user-audit-via-hsl.