F5 如何配置syslog的级别
syslog日志服务器的配置
配置防火墙的Syslog存储到Linux Syslog服务器防火墙日志作为重要的安全审计、安全分析资料，需要保存一段时间，而防火墙本身保存日志的容量有限，可以把防火墙记录的日志存储到用Linux平台做的日志服务器,以Netscreen为例介绍怎样配置Syslog.配置Netscreen的Syslog存储到Linux Syslog服务器将ISG 防火墙(X.X.X.X)的Syslog信息存储到Syslog服务器上(Y.Y.Y.Y)，便于跟踪防火墙状态和日志检查。
一、配置Syslogd更改/etc/syslog.conf配置文件，增加以下部分：# Save Debug Message of Netscreen(Y.Y.Y.Y) to netscreen.logLocal7.* /home/log/netscreen.log将local7设备的信息存储在指定的/home/log/netscreen.log里面，通过这条配置可以将不同设备的log信息存储在不同的文件中，便于查看。
二、配置logrotateLinux中的logrotate程序用于对日志文件的轮询，可以通过限定文件的大小、时间等配置，保存多个日志文件。
更改/etc/logratate.conf文件，增加以下部分：/home/log/netscreen.log {monthlyrotate 12}将syslog中存储的文件/home/log/netscreen.log，按每月的方式保存，共保存12个文件，也就是第一个月保存为netscreen.log，到了下个月将把这个月的文件名换成为netscreen.log.1，依此类推。
三、重新启动syslogdservice syslog restart四、Netscreen 配置：>查看log的等级get event level可以看到当前的netscreen 事件等级，如：alert level 1: immediate action is requiredcritical level 2: functionality is affecteddebug level 7: detailed information for troubleshootingemergency level 0: system is unusableerror level 3: error conditioninformation level 6: general information about operationnotification level 5: normal eventswarning level 4: functionality may be affected选择你需要等级即可，这里我们选择Debug信息。
Syslog 配置介绍
Syslog 简介Syslog是一个通过IP网络允许一台机器发送事件通知信息给事件收集者（Syslog服务器或者Syslog Daemon）的协议。
换言之，就是一台机器或者设备能够被配置，使之产生Syslog 信息并且发送到一台特定的Syslog服务器/Daemon。
Syslog信息建立在UDP之上，一般Syslog信息在UDP514端口上被收集，Syslog信息的长度不大于1024字节。
由于基于UDP协议，所以当如果因为网络拥塞等情况导致信息包丢失，那么信息将不再重发，而是简单的丢失掉。
Syslog协议是在Unix系统上被创建出来的。
使用Syslog，一个远程Unix主机能够很好的跟踪另一台Unix主机。
任何应用程序都能够产生Syslog信息。
格式Syslog包的格式:一个Syslog信息主要有三部分组成。
分别是PRI，HEADER，MSG。
日志信息格式如下：<优先级>时间戳主机名模块名/级别/信息摘要:内容<priority>timestamp sysname module/level/digest:content以上格式中的尖括号（< >）、空格、斜杠（/）、冒号（:）是有效的、必须的。
输出到日志主机的日志格式的例子如下：<189>Jun 7 05:22:03 2003 Quidway IFNET/6/UPDOWN:Line protocol on interface Ethernet0/0/0, changed state to UP以下对每一个字段做详细说明。
1.优先级是优先级的意思，它由两部分组成，共一个字节，前3位是严重度（Severity），后5位是表示Facility。
优先级的计算按如下公式：facility*8+severity-1。
a) 严重度b) Facility2。
Header包括两部分：1>时间戳，它是指信息生成的日期和时间。
F5remotesyslogv10v9.48通用版本
F5remotesyslogv10v9.48通用版本
REMOTE SYSLOG配置手册
V10版本可以使用命令：
b syslog remote server server1 host 10.0.0.1
V9.4.2以上版本使用或者V10版本要求过滤使用：
首先我们在F5命令行/config/创建个文件名叫include.inc 然后我们把下面内容粘贴进去然后我们看到udp(\"10.4.0.1\" port (514));我们可以把里面的IP地址替换成我们自己的REMOTESYSLOG 服务器地址。
syslog include "
destination remote_server {
udp(\"10.4.0.1\" port (514));
udp(\"10.5.0.1\" port (514));
};
filter f_alllogs {
level (notice...emerg);
};
log {
source(local);
filter(f_alllogs);
destination(remote_server);
};"
然后我们在命令行界面
把我们刚才写好的文档载入
然后我们在保存下配置文件
现在F5上的远程日志配置好了，发现重启之后也可以收到日志了，本地的日志也存在。
Facilities介绍：
Levels介绍：。
各交换机品牌syslog设置命令参考
各交换机品牌syslog设置命令参考-------------------------------------------------------------------------------H3C-------------------------------------------------------------------------------# 配置远程日志服务器采集器地址#system-view[H3C]cluser[H3C-cluser]logging-host 10.10.10.10-------------------------------------------------------------------------------华为-------------------------------------------------------------------------------# 查看日志信息dis info-center ## 启用日志#info-center enable# 配置远程日志的日志服务器地址，设置发送日志的级别dis cur | include info-center # info-center loghost10.10.10.10info-center source default channel loghost log level notifications警告级别7级emergencies 紧急情况系统无法使用（严重度= 0）alerts 提醒需要立即采取行动（严重度= 1）critical 临界临界条件（严重度＝2）errors 错误错误条件（严重度= 3）warnings 警告警告条件（严重度= 4）notifications 通知正常但重要的条件（严重度= 5）informational 信息信息信息（严重度= 6）debugging 调试调试消息（严重性= 7）# 开启NTP服务（与时间服务器同步）需要提供时间服务器的地址查看NTP信息dis cur | include ntp #ntp-service authentication enablentp-service unicast-server 10.111.1.10-------------------------------------------------------------------------------思科-------------------------------------------------------------------------------# 查看端口show running-config | in logging 日志发送到日志采集器#Router#configure terminal# 开启日志服务#Cisco(config)#logging on# 设置日志服务器地址#Cisco(config)#logging host 10.10.10.10# 设置发送日志级别一共7级，可以？号来查看提示#logging trap 5# 日志发出用的源IP地址#logging source-interface loopback0#日志缓冲区大小#logging buffered 20480#记录事件连接默认值#logging event link-status defaultlogging facility local1service timestamps log datetime localtimeCisco(config)#endCisco#write0:紧急(Emergencies) emergency—Logs only emergency events.1:告警(Alerts) alert—Logs alert and more severe events.2:严重的(Critical) critical—Logs critical and more severe events.3:错误(Errors) error—Logs error and more severe events.4:警告(Warnings) warning—Logs warning and more severe events.5:通知(Notifications) notice—Logs notice and more severe events.6:信息(Informational) informational—Logs informational and more severe events.7:调试(Debugging) debug—Logs all events, including debug events.# NTP（时间同步）可能需要每个端口开启NTP ，查看NTP信息show logging | include NTP #Router# config tRouter(config)# interface eth0/0Router(config-if)# no ntp disableRouter(config-if)# exitRouter(config)# ntp server 10.111.1.11 source loopback0Router(config)# exitntp update-calendarntp server 10.111.1.11。
F5 SYSLOG输出
syslog-ng配置由于9.4.2版本以后不推荐在通过修改syslog-ng.conf配置文件实现自定义日志输出，下面将通过bigpipe syslog include命令实现需求。
用户现在需要过滤并输出Pool Members的状态信息以及Error以上的告警信息，考虑到通过日志级别无法将负载层面的Log提升到Error级别，所以考虑使用自定义syslog-ng的filter功能实现需求。
1.通过SSH方式登录到命令行下，并执行下面的命令：[root@HQ-I-LC01:Active] config # bigpipe syslog remote server {solarwinds{host 10.80.36.47}}检查配置是否成功执行以下命令：[root@HQ-I-LC01:Active] config # bigpipe syslog remote server all list如果配置Solarwinds服务器命令成功，应返回以下结果：syslog {remote server solarwinds {host 10.80.36.47}}2.新建syslog.inc文件在/tmp目录下新建syslog.inc文件，文件内容如下：[root@test:Active] tmp # vi syslog.incsyslog include " destination d_loghost { udp("10.80.36.47" port(514));};//定义一个syslog服务器地址及端口filter myfilter { match("Pool member") or level(err..emerg);};//定义一个filter抓取irules记录的访问信息log { source(s_syslog_pipe);filter(myfilter);destination(d_loghost);};2. 将syslog.inc重导向到bigpipe shell[root@test:Active] tmp # bpsh < syslog.inc3. 查看设置是否正常[root@test:Active] tmp # b syslog includeSYSLOG - Include Data: destination d_loghost { udp(\"10.80.36.47\"port(514));}; filter myfilter { match(Pool member) or level(err..emerg);};log { source(s_syslog_pipe);filter(myfilter);destination(d_loghost);};" 我们可以看到之前编辑的syslog.inc配置正确写入到配置。
f5日志格式
f5日志格式F5的日志格式主要分为以下几类：1. 系统日志：主要记录需要监控的消息种类和日志文件保存的位置。
系统可以捕捉多种类型的消息，可以按照消息产生的方式和严重程度进行分类。
重要日志文件的位置和主要内容如下：系统日志文件、健康检查日志文件、审计日志、功能模块日志、设备磁盘相关日志、内核日志、功能配置日志、安全相关日志等。
2. 操作日志：登录F5后台操作命令可参考Linux命令。
F5日志格式通常指F5负载均衡器生成的日志，用于记录网络流量、访问请求、系统事件等信息。
这些日志对于监控网络性能、排查问题以及安全审计都至关重要。
F5日志的格式可以根据用户的需求进行自定义配置，但通常会包含以下关键字段：1. 时间戳：记录事件发生的具体时间，有助于事件排序和问题追踪。
2. 客户端IP：发起请求的客户端或用户IP地址。
3. 虚拟服务器：处理请求的F5虚拟服务器名称或IP。
4. 请求方法：如GET、POST等HTTP请求方法。
5. URL：访问的具体网页或资源路径。
6. 响应代码：如200 OK、404 Not Found等HTTP响应状态码。
7. 字节数：传输的数据量，通常包括请求和响应的大小。
8. 会话ID：唯一标识一个用户会话的编号。
9. 连接信息：包括源端口、目标端口等网络连接细节。
10. 其他自定义字段：根据用户需求添加的额外信息，如用户代理、引用页等。
F5日志通常以文本形式保存，可以使用标准的日志分析工具进行解析和查询。
通过分析这些日志，管理员可以快速了解网络负载情况、识别潜在的安全威胁，并优化网络性能。
由于F5设备广泛应用于企业网络环境，因此其日志格式和管理对于网络管理员来说是非常重要的。
F5命令行配置配置手册
bigstart Restarts the SNMP agent bigsnmpd. bigtop Displays real-time statistics.Config Configures the IP address, network mask, and gateway on the management (MGMT) port.Use this command at the BIG-IP system prompt prior to licensing the the BIG-IP system, and do not confuse it with the bigpipe config command or the BIG-IP Configuration utility.halt Shuts down the BIG-IP software application.hostname Displays the name you have given to the BIG-IP system.printdb Prints the values of one or more entries in the bigdbTM database. reboot Reboots the BIG-IP system.ssh and scp Access command line interfaces on other SSH-enabled devices, and copy files to or from a BIG-IP system.自定义Bigpipe shell名称bp> shell prompt <string>bp> shell prompt BIG-IP>系统Shell名称将变成:BIG-IP>此特性避开此限制,在Linux命令前加”!”.BIG-IP>!ls //查看目录BIG-IP>!ifconfig //查看接口配置•Routes•Self IP addresses•Packet Filters•Trunks (802.3ad Link Aggregation)•Spanning Tree Protocol (STP)•VLANs and VLAN groups•ARP配置Packet Filtering命令: bigpipe packet filter你可以定义一个包过滤规则来提供访问控制,速率shaping,审计. 配置路由命令:route (<route key list> | all | inet | inet6)F5的Show Tech[root@XXXX:Standby] config # qkviewGetting systemwide backup configuration files.Getting AOM information.Getting last 175 lines of log files.Getting last 175 lines of gzipped log files.Getting md5 sum information.Getting core file list.Getting Public Certificate information.Getting tmctl information.completed... 6 of 161 checks produced no dataDiagnostic information has been saved in file /var/tmp/-tech.out Please send this file to **************.bigtop - display real-time statistics-bytes display counts in bytes (vs bits)-pkts display counts in packets (vs bits)-reqs display counts in requests (vs connections)-vips <n> number of virtual servers to print-nodes <n> number of nodes to print-once print once and exit-delay <n> number of seconds between samples (default 4)-scroll disable full-screen mode-nosort disable sorting-conn sort by connection count (vs byte count)-delta sort by count since last sample (vs total)-n print IP address and services in numeric format-vname display virtual servers by name (vs IP address)-help, -h print this message日志文件系统1. Access the BIG-IP system prompt.2. Stop the BIG-IP system or put the system into a safe condition such as standby mode using the bigstart stop command.3. Type the following command:resize-logFSThis command prompts you for the desired file size in gigabytes.4. At the prompt, type an integer.The minimum allowed value is 1, and the maximum allowed value is 10.A prompt appears that allows you to confirm the specified file size.5. Type Y.A message appears, notifying you of the need for the BIG-IP system to perform a reboot, followed by a prompt, which allows you to permit the reboot operation. Note: Prior to rebooting, the BIG-IP system verifies that the integer you typed in step 3 is within the allowed range, and checks to ensure that enough disk space exists for the specified size.6. Type Y.A confirmation prompt appears.7. Type Y.The system displays messages indicating that the reboot operation is about to occur.8. Wait for the reboot operation to finish.When the system becomes available again, the newly-specified disk space for the log file will be in effect.WARNINGDo not delete the files: /shared/.LoopbackLogFS and /shared/LogFS_README, because this action deletes all of your log files.启用/禁用虚拟服务或虚拟地To enable or disable a virtual server, use the appropriate command syntax:bp> virtual <virtual addr>:<virtual port> enable | disableTo enable or disable a virtual address, use the appropriate command syntax:bp> virtual address <virtual addr> enable | disable从服务中移出单个的NodeYou can remove an individual node from service, or return an individual node to service from the bigpipe shell command line.To remove an individual node from service, use the following command:bp> node <node addr>:<node port> downTo return an individual node to service, use this command:bp> node <node addr>:<node port> up查看修改F5系统配置文件器来编辑或者查看这些文件,当你没有条件使用浏览器时,有时候修改配置文件很有必要.这就需要F5的无浏览器配置模式和命令行配置模式Important:在你编辑完bigip.conf or bigip_base.conf 重启MCPD service之前, 你必须运行bigpipe load 确保MCPD service 使用的是当前的配置数据alert.conf Stores definitions of SNMP traps (system default alerts).user_alert.conf Stores definitions of SNMP traps (user-defined alerts)./config/bigip.conf Stores all configuration objects for managing local application traffic, such as virtual servers, load balancing pools, profiles, and SNATs.Note that after you edit bigip.conf, and before you restart the MCPD service, you must run the bigpipe load command./config/bigip_base.conf Stores BIG-IP self IP addresses and VLAN and interface configurations. Note that after you edit bigip_base.conf, and before you restart the MCPD service, you must run the bigpipe load command./config/bigip.license Stores authorization information for the BIG-IP system./etc/bigconf.conf Stores the user preferences for the Configuration utility./config/bigconfig/openssl.conf Holds the configuration information for how the SSL library interacts with browsers, and how key information is generated./config/user.db Holds various configuration information. This file is known as the bigdb database. /config/bigconfig/httpd.conf Holds configuration information for the web server./config/bigconfig/users The web server password file. Contains the user names and passwords of the people permitted to access whatever is provided by the webserver./etc/hosts Stores the hosts table for the BIG-IP system./etc/hosts.allow Stores the IP addresses of workstations that are allowed to make administrative shell connections to the BIG-IP system./etc/hosts.deny Stores the IP addresses of workstations that are not allowed to make administrative shell connections to the BIG-IP system./etc/rateclass.conf Stores rate class definitions./etc/ipfwrate.conf Stores IP filter settings for filters that also use rate classes. /etc/snmpd.conf Stores SNMP configuration settings./etc/snmptrap.conf Stores SNMP trap configuration settings./config/ssh Contains the SSH configuration and key files./etc/sshd_config This is the configuration file for the secure shell server (SSH). It contains all the access information for people trying to get into the system by using SSH./config/routes Contains static route information.[root@ISAG-2:Standby] config # find_keysISAG-2 koradsatn. omtitra eodISAG-2 junl trig Cmi nevl5scnsdt md.6koradsatn. omtitra eodFound license key JTPBO-CHRSX-DGBIO-HOAHJ-MOZJEVALicense file location is: /sda.1/config/bigip.licenseFound license key JTPBO-CHRSX-DGBIO-HOAHJ-MOZJEVAUnmounting unneeded partitions... ISAG-2 junl trig Cmi nevl5scnsn Cmi nevl5scnsree aamd.<>junl trig Cmi nevl5scns<6>EXT3-fs: mounted filesystem with ordered data mode.ISAG-2 junl trig Cmi nevl5scns<6>kjournald starting. Commit interval 5 secondscompleteAbove information can be found in /tmp/keys.outManaging Local Application Traffic•Setting up load balancing•Controlling HTTP traffic•Implementing HTTP and TCP optimization profiles•Authenticating application traffic•Implementing persistence•Enhancing the performance of the BIG-IP system•Managing health and performance monitors•Implementing iRules设置VirtualServer负载均衡1. Decide what types of traffic you want the BIG-IP system to manage, as well as whether you want to implement session persistence, connection persistence, and remote authentication.2. For each decision in step 1, decide whether you want to use the corresponding default profile that the BIG-IP system provides, or whether you want to create a custom profile.3. Access the bigpipe shell.4. If you want to create custom profiles, use the profile command, specifying the appropriate type of profile as an argument. If you do not want to create custom profiles, skip this step.5. Create one or more load balancing pools, using the pool command.6. Create a virtual server, using the virtual command, and assign to it any profiles and pools that you created. If you are using default profiles, some of those profiles might already be assigned to the virtual server by default.配置克隆Pool克隆Pool设计是用于入侵检测,你可以针对一个VS设置一个克隆Pool,这个克隆的VS接收世的流量和普通Pool一样,你就可以复制流量到入侵检测系统中.1. Access the bigpipe shell.2. Use the virtual command, to create or modify a virtual server, specifying a value for the clone pool argument.配置最后一跳Pool默认,BIG-IP系统自动启用最后一跳特性是,如果你想禁用这个特性.然后自己手工定义一个最后一跳路由器,你可以建立一个最后一跳pool并且指定其属于某个VS当中.1. Access the bigpipe shell.2. Use the pool command to create a last hop pool that contains the router inside addresses.3. Use the lasthop pool argument with the virtual command to assign the last hop pool to a virtual server.If you have not assigned an SSL profile to the virtual server, use the profile argument with the virtual command to assign the profile to the virtual server.配置SNATs这里有两种基础方法来建议一个SNAT,你可以直接将一个转换地址委派给一个或多个源IP地址,或者你可以配置一个SNAT pool,然后委派这个SNAT pool到某个源IP地址,在较新的版本中,BIG-IP自动从SNAT Pool中选择一个转换地址Note that you can assign these types of mappings from within an iRule.To map a single translation address to an original address1. Access the bigpipe shell.2. Designate an IP address as a translation address, using the snat translation command.3. Map the translation address to one or more original IP addresses, using the snat command or the rule command.To map a SNAT pool to an original address1. Access the bigpipe shell.2. Create a pool of translation addresses (that is, SNAT pool), using the snatpool command.3. Map the SNAT pool to one or more original IP addresses, using either the snat command or the rule command.配置HTTP traffic你可以配置BIG-IP来控制HTTP流量:配置HTTP压缩,HTTP请求重定向,HTTP请求重写,插入和插除HTTP头,启用或者禁用cookie加密和SYN cookie支持,配置HTTP 类Profile, HTTP响应数据组块控制.Configuring HTTP compression配置BIG-IP系统压缩HTTP 服务响应1. Access the bigpipe shell.2. Configure the compression-related settings of an HTTP profile,using the profile http command.3. Assign the HTTP profile to a virtual server, using the virtual command.Redirecting HTTP requests你可以配置HTTP Profile来重定向HTTP请求,并且在这个Profile中定义一个Fallback主机1. Access the bigpipe shell.2. Using the profile http command, create or modify an HTTP profile, specifying a value for the fallback argument. You can specify either a URI or the default fallback host, or you can specify that you want no HTTP redirection.3. Verify that the HTTP profile you created or modified is assigned to a virtual server.Rewriting HTTP redirections你可以配置HTTP Profile来重写HTTP的重定向规则1. Access the bigpipe shell.2. Using the profile http command, create or modify an HTTP profile, specifying a value for the redirect rewrite argument.For example, to create a profile that only rewrites URIs matching the originally requested URI (minus an optional training slash), use the following syntax:profile http myHTTPprofile { redirect rewrite matching }3. Verify that the HTTP profile you created or modified is assigned to a virtual server.Inserting and erasing HTTP headers你可以配置HTTP Profile来插入一个头文件到HTTP请求,或者从HTTP请求中移出一个头文件1. Access the bigpipe shell.2. Using the profile http command, create or modify an HTTP profile, specifying a value for either the header insert, header erase, or insert xforwarded for options.3. Verify that the HTTP or Fast HTTP profile you created or modified is assigned to a virtual server.Enabling or disabling cookie encryption你可以使用Profile http中的两个选项来启用或者禁用cookie加密1. Access the bigpipe shell.2. Using the profile http command, create or modify an HTTP profile, specifying a value for the encrypt cookie and cookie secret options.3. Verify that the HTTP profile you created or modified is assigned to a virtual server.Enabling or disabling SYN cookie support为了管理DOS攻击,你可以在一个Fast L4 Profile中配置SYN Cookie选项启用或者禁用SYN Cookie支持功能◆如果BIG-IP系统包含了Packet Velocity ASIC (PVA)技术,使用profile fastl4命令,定义一个hardware syncookie(enable | disable | default)选项,同样,你可以根据需求设置以下的变量通过db命令.•pva.SynCookies.Full.ConnectionThreshold (default: 500000)•pva.SynCookies.Assist.ConnectionThreshold (default: 500000)•pva.SynCookies.ClientWindow (default: 0)值得注意的是这个hardware syncookie 特性目前只可用于D84和D88平台.在其实平台设备这个特性无效.所以如果你在D84和D88上设置software syncookie 特性,SYN Cookie只通过软件处理◆如果BIG-IP系统不包含Packet Velocity ASIC(PVA)技术,使用profile fastl4 命令,指定为software syncookie (enable | disable | default) option.Configuring the HTTP Class profileBIG-IP系统包含一种Profile叫做HTTP Class Profile,你可以使用你定义的标准来用分类HTTP流量,当你分类流量的时候,你转地流量的原则是根据审查目标流量的头文件或者内容来定.如果BIG-IP系统包含Application Security Manager (ASM)或者WebAcclerator模块,你可以配置系统来先发送HTTP流量到那个模块,然后再发送到最终目标,例如,你可以使用HTTP Class Profile来对Virtual Server下命令,要求它发送流量先经过ASM然后再转发到负载均衡Pool.Unchunking and rechunking HTTP response data如果你想要监控内容你可以取消或者重新对HTTP响应进行组块操作,只需要配置HTTP Profile来启用unchunking功能.1. Access the bigpipe shell.2. Using the profile http command, create or modify an HTTP profile and specify the response argument.3. Make sure that you have assigned the HTTP profile to a virtual server, using the virtual command.你能够设备的保持有以下几种:实施Session保持•Cookie•Destination Address Affinity•Microsoft Remote Desktop Protocol (MSRDP)•Hash•Session Initiation Protocol (SIP)•Source Address Affinity•SSL•Universal具体操作:1. Access the bigpipe shell.2. Create a persistence profile, using the profile command, that corresponds to the type of persistence you want to implement.3. Assign the persistence profile to a virtual server, using the persist and fallback persist arguments with the virtual command.实施连接保持为了实施连接保持,你可以添加一个Keep-Alive头文件到HTTP /1.0头文件里(如果不存在).(默认HTTP/1.1连接包含Keep-Alive支持),你同样可以启用connection pooling特性,它可以保持服务器端的连接打开,重新用来供其它客户端请求所使用.你可以通过修改HTTP或者Fast HTTP Profile文件来启用keep-alive支持和Connection pools.同样可以修改OncConnect Profile来实现.To add Keep-Alive headers into HTTP requests1. Access the bigpipe shell.2. To ensure that HTTP connections stay open, use the profile http command and specify the oneconnect transformations argument. This ensures that the BIG-IP system inserts aConnection:Keep-Alive header into any HTTP /1.0 request that does not already contain one.3. Make sure that you have assigned the HTTP or Fast HTTP profile to a virtual server, using the virtual command.To enable connection pooling1. Access the bigpipe shell.2. Using the profile oneconnect command, configure a profile for connection pooling.3. Assign the profile to a virtual server, using the profile argument with the virtual command.小提示:你同样可以通过配置Fast HTTP Profile来配置连接保持,在BIGPIPE SHEEL中使用fasthttp命令.加强BIG-IP性能BIG-IP系统.设置连接Qos和数据包TOS等级你可以使用bigpipe工具来设置QoS和TOS等级,你不仅可以对所有具有目标负载均衡Pool的流量做,同时你也可以对自定义的流量做,例如:Layer 4 ,TCP 和UDP流量.1. Decide whether you want to set QoS and ToS levels for traffic targeted for an entire pool or for specific types of traffic, or both.•If you want to set the QoS and ToS levels for an entire pool, access the bigpipe shell and use the pool command with one or more of the following arguments: link qos to client, link qos toserver, ip tos to client, and ip tos to server.•If you want to set the QoS and ToS levels for certain types of traffic, access the bigpipe shell and use the profile command to create or modify a Fast L4, TCP, or UDP profile.2. Verify that the pool or the profile that you created or modified is assigned to a virtual server. To do this, use the following syntax:bp> virtual <virtual server name> list设置空闲超时时间(Idle timeout time)或者修改一个Fast L4,Fast HTTP,TCP,或者UDP Profile.1. Create or modify a Fast L4, Fast HTTP, TCP, or UDP profile, by accessing the bigpipe shell and using the profile command.2. Specify the idle timeout argument to set a timeout value.3. Verify that the profile you created or modified is assigned to a virtual server.实施速率整形Virtual Server或者Packet Filter规则中.1. Access the bigpipe shell.2. Create one or more rate classes, using the rate class command.3. Assign the rate classes to a virtual server or a packet filter rule, using either the virtual command or the packet filter command.Implementing iRulesiRule特性强大而灵活,值得注意的是它可以增强BIG-IP系统能力.一个iRule可以引用任意object,它不管这个被引用的object处理哪个分区里.例如;一个iRule属于分区A,但包含指定一个Pool属于分区B的语句.1. Access the bigpipe shell.2. Create an iRule using the rule command. You must include the name of the Tcl script and the script itself as arguments for the command.3. Assign the iRule to a virtual server, using the virtual command in one of the following ways:•To associate multiple iRules with a virtual server, use this syntax:bp> virtual <virtual_server_name> rule <iRule1_name> \ <iRule2_name> ...•To remove the assignment of an iRule from a virtual server, use this syntax:bp> virtual <virtual_server_name> rule none•To remove the iRule assignments from multiple virtual servers, use the following syntax. Note that you can remove the iRule assignments only from virtual servers that reside in the current Write partition or in partition Common.bp> virtual all rule none•To associate an existing iRule with multiple virtual servers, use the following syntax. Note that you can associate an iRule only with virtual servers that reside in the current Write partition or in partition Common. bp> virtual all rule <iRule_name>Important: In this case, the iRule becomes the only iRule that is associated with each virtual server in the current Write partition. Because this command overwrites all previous iRuleassignments, we do not recommend use of this command.。
F5 V9平台syslog-ng配置指南
在文件中定位到local0.*(注 意前面的#号不要去掉)
这部分为新增加部分，可以加 多个syslog server地址。 remote_syslog_server为定义 的变量名称，下面会引用到。
# local0.* filter f_local0 {
/var/log/ltm
facility(local0) and level(info..emerg); };
log { source(local); f程syslog server的定义。 的定义。 增加远程 的定义 引用上面定义的远程syslog 引用上面定义的远程 server 的变量名称
destination(remote_syslog_server); destination(d_ltm ); };
为了把日志也能保留在 本地一份， 本地一份，这部分保留 不要去掉。 不要去掉。
destination d_ltm { file("/var/log/ltm" create_dirs(yes)); }; destination remote_syslog_server { udp("11.129.10.248" port(514)); udp("11.129.10.241" port(514)); };
如果需要的话，保留一份日志 在本地。否则的话系统将日志 全部发往外部syslog server.万 一网络故障，网管收不到任何 日志。本地如果不留就没有日 志保存了。
配置文件修改过之后注意： 配置文件修改过之后注意： 重启syslog-ng进程 进程 重启 #bigstart restart syslog-ng (其他有用的命令 其他有用的命令) 其他有用的命令 #cat /var/run/syslog-ng.pid 查找进程号 #bigstart start syslog-ng 启动 启动syslog-ng进程 进程 #bigstart shutdown syslog-ng 停止 停止syslog-ng进程 ) 进程
- 1、下载文档前请自行甄别文档内容的完整性，平台不提供额外的编辑、内容补充、找答案等附加服务。
- 2、"仅部分预览"的文档,不可在线预览部分如存在完整性等问题,可反馈申请退款(可完整预览的文档不适用该条件!)。
- 3、如文档侵犯您的权益，请联系客服反馈,我们会尽快为您处理(人工客服工作时间：9:00-18:30)。
How do I configure syslog?
Description:
Product Version
3-DNS 1.0.3 through 4.6
BIG-IP 2.1.2 through 4.6
Updated: 02/10/04
How do I configure syslog?
Resolution:
BIG-IP and 3-DNS use the standard UNIX log utility called syslog, which reads messages from TCP, UDP, and UNIX sockets.
The UNIX socket is located in the /var/run/log= file, and messages from the kernel are located in the /dev/klog file. You can configure BIG-IP or 3-DNS to direct messages to files, a console, or to another syslog compliant server.
Facilities
The syslog utility can log to the following facilities:
Name Facility Description
auth User authentication system for non-sensitive
information.
authpriv User authentication system security sensitive
information.
cron The cron facility.
daemon System server processes.
ftp The ftp facility.
kern The Kernel.
lpr The printing subsystem.
mail The mail subsystem.
mark Timestamps produced at regular intervals.
news News server processes.
ntp The NTP time daemon.
syslog syslog facility internal messages.
user User processes.
lucp The UUCP facility.
Levels
The following 0-7 levels messages are provided for each facility:
Level Name Description
0 emerg System panic.
1 alert Serious error requiring immediate
attention.
2 crit Critical errors, such as hard drive
errors.
3 err Non-critical errors.
4 warning Warnings.
5 notice Non-critical messages.
6 info Informative messages.
7 debug Additional information for
troubleshooting problems.
Modifying the destination of syslogd log files
Specifying the location of log files for specific applications can be helpful for debugging purposes. To modify the destination of the syslogd log files, edit the /etc/syslog.conf file using one of the following examples:
<facility>.<level><path to file>
or
<facility>.<level>,<facility>.<level> <path to file>
Examples of syslog configuration options
To log all facilities and all levels to /var/log/messages, configure the syslog.conf file as follows: *.* /var/log/messages
To log all kernel messages to /var/log/kernel, configure the syslog.conf file as follows:
kern.* /var/log/kernel
To log all critical kernel messages to /var/log/kernel, configure the syslog.conf file as follows: kern.crit /var/log/kernel
To log a combination of critical and debug kernel messages to /var/log/kernel.debug, configure the syslog.conf file as follows:
Important: Put only a comma between the multiple facilities entries, no spaces.
kern.crit,kern.debug /var/log/kernel
To log all critical and debug kernel messages to a serial console, configure the syslog.conf file as follows:
Note: This is the equivalent of logging to com1 in DOS.
kern.crit,kern.debug /dev/tty00
If you have an application in /usr/bin/filter.pl to filter messages, configure the syslog.conf file as follows:
*.* |/usr/bin/filter.pl
To log messages to another syslog server, configure the syslog.conf file as follows:
*.* @
To log all sshd2 messages to the /var/log/ssh.log file, configure syslog.conf as follows:
!sshd2
*.* /var/log/ssh.log。