肖建彬的博客

作者: 肖建彬 | 可以转载, 转载时务必以超链接形式标明文章原始出处和作者信息及版权声明
网址：http://www.xiaojb.com/archives/it/f5log.shtml

f5->syslogd->syslogd@192.168.0.1->file

f5
/etc/syslog.conf
local1.* @192.168.0.1

192.168.0.1
/etc/syslog.conf
local1.* /var/log/f5/f5.log

/etc/logrotate.d/syslog
/var/log/messages /var/log/secure /var/log/maillog /var/log/spooler /var/log/boot.log /var/log/cron /etc/log/f5/f5.log {
sharedscripts
postrotate
/bin/kill -HUP `cat /var/run/syslogd.pid 2> /dev/null` 2> /dev/null || true
endscript
}

man syslog
man logrotate

F5 v9使用的syslog server是syslog-ng
看看/etc/syslog-ng/syslog-ng.conf中有关ltm log的定义

加上

destination loghost {
udp(ip(192.168.0.1) port (514));
};

log {
source(local);
filter(f_local0;
destination(loghost);
};

本文未经测试，如果遇到困难，请man syslog-ng.conf