Last Modified: Sep 13, 2023
Affected Product(s):
BIG-IP AFM
Known Affected Versions:
12.1.1, 12.1.2, 12.1.3, 12.1.3.1, 12.1.3.2, 12.1.3.3, 12.1.3.4, 12.1.3.5, 12.1.3.6, 12.1.3.7, 12.1.4, 12.1.4.1, 12.1.5, 12.1.5.1, 12.1.5.2, 12.1.5.3, 12.1.6
Opened: Apr 18, 2017 Severity: 5-Cosmetic
When using custom field-list property in logging publisher of an AFM security logging profile, and when using remote syslog and rfc5424 format logging, the following sysdb config must also be set to true for the custom field-list property settings to take effect. Sysdb tunable is required for this configuration to take effect: modify sys db tm.fw.log.syslogrfc5424.customfields value true Relevant remote logging destination config with format rfc5424, provided here as an example. sys log-config destination remote-syslog /Common/LOG_REMOTE_SYSLOG { description "Remote Syslog via HSL" format rfc5424 remote-high-speed-log /Common/LOG_REMOTE_HSL }
Configured custom logging fields for remote syslog rfc5424 format does not take effect.
This occurs when configuring the Storage Format Field-List for AFM logging.
modify sys db tm.fw.log.syslogrfc5424.customfields value true
None