Last Modified: Mar 26, 2026
Affected Product(s):
BIG-IP AFM, APM, ASM, AVR, BIG-IQ, DNS, F5OS-C, GTM, LTM
Known Affected Versions:
16.1.6.1, 17.1.3.1, 17.5.1.5, 21.0.0, 21.0.0.1
Opened: Mar 18, 2026 Severity: 4-Minor
The GUI audit logs in the /var/log/audit files have a different format from all other daemons audit logs. This is an example of a GUI audit log: Mar 18 04:50:39 localhost.localdomain info GUI[10683@bigip-2.f5.internal]: 00000001:20000: AUDIT - user admin - RAW: GUI: host=192.168.1.1 user=admin partition=Common action=list object=[All] type=Certificate and Key result=OK that is different from most of the other audit log formats. This is an example of a tmsh audit log: Mar 18 04:46:06 bigip-2.f5.internal notice tmsh[1454]: 01420002:5: AUDIT - pid=1454 user=root folder=/Common module=(tmos)# status=[Command OK] cmd_data=save / sys config partitions all
The different format can be confusing because log elements are in different positions. The different format could also be problematic when audit logs are ingested into a log repository or SIEM, because different entries require a separate parsing logic.
GUI audit logs are enabled. From the GUI selecting: "System ›› Logs : Configuration : Options". Then, under 'Audit Logging', set 'GUI' to 'Enable'. or from TMSH with: "tmsh modify sys global-settings gui-audit enabled"
None
None