Bug ID 659063: Remote syslog and rfc5424 format logging

Last Modified: Sep 13, 2023

Affected Product(s):
BIG-IP AFM(all modules)

Known Affected Versions:
12.1.1, 12.1.2, 12.1.3, 12.1.3.1, 12.1.3.2, 12.1.3.3, 12.1.3.4, 12.1.3.5, 12.1.3.6, 12.1.3.7, 12.1.4, 12.1.4.1, 12.1.5, 12.1.5.1, 12.1.5.2, 12.1.5.3, 12.1.6

Opened: Apr 18, 2017

Severity: 5-Cosmetic

Symptoms

When using custom field-list property in logging publisher of an AFM security logging profile, and when using remote syslog and rfc5424 format logging, the following sysdb config must also be set to true for the custom field-list property settings to take effect. Sysdb tunable is required for this configuration to take effect: modify sys db tm.fw.log.syslogrfc5424.customfields value true Relevant remote logging destination config with format rfc5424, provided here as an example. sys log-config destination remote-syslog /Common/LOG_REMOTE_SYSLOG { description "Remote Syslog via HSL" format rfc5424 remote-high-speed-log /Common/LOG_REMOTE_HSL }

Impact

Configured custom logging fields for remote syslog rfc5424 format does not take effect.

Conditions

This occurs when configuring the Storage Format Field-List for AFM logging.

Workaround

modify sys db tm.fw.log.syslogrfc5424.customfields value true

Fix Information

None

Behavior Change

Guides & references

K10134038: F5 Bug Tracker Filter Names and Tips