Splunk UF on F5 BIG-IP for OS logs

[fishmong3r0]

Hey Community,

We have 2 BIG-IP load balancer VMs and need to have the OS logs (like audit.d) forwarded to Splunk. So, this is not about the F5 application logs themselves, but the OS logs from the underlying system.

Is there a way to do this?

Much appreciate your support.

[PickleRick]

BIG-IP uses syslog-ng so the easiest approach would probably be to reconfigure it to send events to a remote destination. Then receive and ingest as you'd do with any other syslog source (with rsyslog/plain syslog-ng/SC4S... I wouldn't advise using built-in network port input)

See for example https://my.f5.com/manage/s/article/K13080