Last Modified: Jun 19, 2025
Affected Product(s):
BIG-IP TMOS
Known Affected Versions:
17.1.0, 17.1.0.1, 17.1.0.2, 17.1.0.3, 17.1.1, 17.1.1.1, 17.1.1.2, 17.1.1.3, 17.1.1.4, 17.1.2, 17.1.2.1, 17.1.2.2
Opened: Mar 05, 2025 Severity: 4-Minor
When a syslog include filter includes a local log source, the log level filter is ignored for the remote syslog server.
Log level is not displayed. This makes it difficult to understand the priority of the logs on the remote system.
Add an include filter with source,filter,destination and configure source as local: include " filter f_remote_loghost { facility(local0) and level(info..emerg); }; destination d_remote_loghost { udp(\"<ip>\" port(514)); }; log { source(local); filter(f_remote_loghost); destination(d_remote_loghost); }; "
Include s_syslog_pipe as source in the include filter Steps to apply: 1. Login to tmsh and execute the command to edit the config : tmsh edit /sys syslog all-properties 2.Add the below include config: include " filter f_remote_loghost { facility(local0) and level(info..emerg); }; destination d_remote_loghost { udp(\"<ip>\" port(514) ); }; log { source(s_syslog_pipe); filter(f_remote_loghost ); destination(d_remote_loghost); }; " 3.Save the file and restart syslog with the command: bigstart restart syslog-ng 4. This will reflect the logs with priority in the remote server
None