Accenture MDR Quick Start Guide for F5® BIG-IP Local Traffic Manager (LTM)

This quick start guide will help Accenture MDR customers configure F5® BIG-IP Local Traffic Manager (LTM) to send logs to the Log collection Platform (LCP).

The document includes the following topics:

Supported Versions

A list of supported versions is available in the Accenture MDR Supported Products List document (Accenture_MDR_Supported_Products_List.xlsx) which can be found in Accenture MDR Portal.

Port Requirements

Table 1-1: Port requirements for LCP communication.

Configuring F5 BIG-IP LTM

 Note: LTM event logs such as [ssl_acc] and [ssl_req] are unsupported by the collector, so these log types must be filtered out on the device.

To configure F5 BIG-IP LTM to send event logs to the LCP, follow the steps below: 

1. Login to SSH using root credentials.

2. Log in to the Traffic Management Shell (tmsh) by typing the command: #tmsh 

3. To send filtered log messages to remote syslog servers, type the following command:​ tmos)#modify /sys syslog remote-servers none 

Note: The remote-servers statement needs to be removed and then a syslog "include" statement that defines a filter rule and the remote server should be entered.

4. To define the desired syslog filter that references the remote server, type the following command: (tmos)#edit /sys syslog all-properties     

5. Replace the include none command line with the following filter:

 Note: Add the LCP IP address and port number in the filter.

include "

filter f_remote_loghost {

level(debug..emerg);

};

filter f_ssl_acc {

not match(\"ssl_acc\");

};

filter f_ssl_req {

not match(\"ssl_req\");

};

destination d_remote_loghost {

udp(\"<lcp_ip_address>\" port(514));

};

log {

source(s_syslog_pipe);

filter(f_remote_loghost);

filter(f_ssl_acc);

filter(f_ssl_req);

destination(d_remote_loghost);

};

"

6. To exit the text editor, type Esc and then enter wq!

7. Save the configuration by typing the command: (tmos)#save /sys config

LCP Configuration Parameters

Table 1-2: The F5 BIG-IP LTM event collector (3371 – Syslog) properties to be configured by MDR are shown in the table.