Logging, F5 BigIP
From NetworkStuff
Information on logging, log files, log rotation and more on F5 Network's F5 BigIP devices.
Contents |
Log File Locations & Usage
F5 BigIP logs are stored in the /var/log/ and /shared/log/ directory, files include;
- /var/log/ltm - Local Traffic Manager (LTM) log
- /var/log/gtm - Global Traffic Manager (GTM) log
- /var/log/tmm - Traffic Microkernel Manager (TMM) log
- /var/log/pktfilter - Packet Filter log
- /var/log/messages - System log
- /var/log/secure - Security log - generally user authentication messages
- /var/log/daemon.log - Local daemon log, used by the snmp and ntp daemons
- /shared/log/kern.log - Linux OS Kernel log
- /var/log/audit - CLI Audit Log (CLI auditing is enabled with the bigpipe cli command)
- /var/log/httpd/* - HTTP Daemon log files
- /var/log/tomcat4/* - Tomcat log files
- /shared/log/install - Software installation log
- /shared/log/eud.log - End User Diagnostics (EUD) log
Log Rotation
Logs are archived for a the last 7 days by default; this occurs daily, when that day’s log is saved to a gzip archive and a new log file is created. However, if there are no log entries on a particular day, this process will be skipped until there are some log entries. Hence the log files can cover a period greater than 7 days but only 7 days of actual logs have been archived, but those 7 days were not the last 7.
Use the bigpipe logrotate command to adjust the number of days logs are archived for.
Viewing Compressed Log Files
Uncompress files using the gzip -d log-file-name.gz command and then view using; more, less, tail or any other available program.
To view the contents of a log file without uncompressing it, use one of the following commands;
Related Articles
For more details on the location of various files on F5 BigIP systems, see this article: File locations, F5 BigIP.
For general Linux file system information, see our Linux File System Hierarchy and Linux File Locations articles.
 We really do appreciate all feedback so please do send your comments, suggestions or corrections to steve#networkstuff.eu (replacing the # with an @)
|
