Collect F5 BIG-IP LTM logs

This document describes how you can collect F5 BIG-IP Local Traffic Manager (LTM) logs by using a Google Security Operations forwarder.

For more information, see Data ingestion to Google Security Operations.

An ingestion label identifies the parser which normalizes raw log data to structured UDM format. The information in this document applies to the parser with the F5_BIGIP_LTM ingestion label.

Configure F5 BIG-IP LTM

1. Sign in to SSH using root credentials.

2. Sign in to the Traffic Management Shell (tmsh) with the following command:

   tmsh

3. Send filtered log messages to remote syslog servers with the following command:

   modify /sys syslog remote-servers none

4. Remove the remote-servers statement and then add a syslog include statement that defines a filter rule and the remote server.

5. To define the required syslog filter that references the remote server, use the following command:

   edit /sys syslog all-properties

6. Replace the include none command with the following filter and add the IP address and port number.

   include "
   
   filter f_remote_loghost {
   
   level(debug..emerg);
   
   };
   
   filter f_ssl_acc {
   
   not match(\"ssl_acc\");
   
   };
   
   filter f_ssl_req {
   
   not match(\"ssl_req\");
   
   };
   
   destination d_remote_loghost {
   
   udp(IP_ADDRESS PORT);
   
   };
   
   log {
   
   source(s_syslog_pipe);
   
   filter(f_remote_loghost);
   
   filter(f_ssl_acc);
   
   filter(f_ssl_req);
   
   destination(d_remote_loghost);
   
   };
   
   "
   

   Replace IP_ADDRESS with the Google Security Operations forwarder IP address and port with the high port number.

7. To exit the text editor, press Esc and then enter wq!.

8. Save the configuration with the following command:

   save /sys config

Configure Google Security Operations forwarder and syslog to ingest F5 BIG-IP LTM logs

1. Go to SIEM Settings > Forwarders.
2. Click Add new forwarder.
3. In the Forwarder Name field, enter a unique name for the forwarder.
4. Click Submit. The forwarder is added and the Add collector configuration window appears.
5. In the Collector name field, type a name.
6. Select F5 BIGIP LTM as the Log type.
7. Select Syslog as the Collector type.
8. Configure the following mandatory input parameters:
   • Protocol: specify the protocol.
   • Address: specify the Google Security Operations forwarder IP address.
   • Port: specify the port.
9. Click Submit.

For more information about Google Security Operations forwarders, see Google Security Operations forwarders documentation. For information about requirements for each forwarder type, see Forwarder configuration by type.

If you encounter issues when you create forwarders, contact Google Security Operations support.

Field mapping reference

This parser normalizes F5 BIG-IP Local Traffic Manager (LTM) logs, handling both key-value and syslog formats. It extracts fields like IP addresses, usernames, actions, and descriptions, mapping them to the UDM, and categorizes events based on log content and extracted fields, including network connections, user logins/logouts, and generic events.

UDM Mapping Table

Need more help? Get answers from Community members and Google SecOps professionals.