AskF5 Knowledge Base

Applies To:

Show Versions Show Versions
Manual Chapter: Logging and Reporting
Manual Chapter
Table of Contents   |   << Previous Chapter   |   Next Chapter >>

17 
 
Logging and Reporting
Understanding logging
Understanding log types
Setting log levels
Understanding reports
Viewing statistics
Monitoring system and user information
Understanding logging
Viewing and maintaining log messages is an important part of maintaining the Access Policy Manager. Log messages inform you on a regular basis of the events that are happening on the system. Some of these events pertain to general events happening within the system, while other events are specific to the Access Policy Manager, such as stopping and starting Access Policy Manager system services.
The Access Policy Manager uses syslog-ng to log events. The syslog-ng utility is an enhanced version of the standard logging utility syslog.
The type of events messages available on the Access Policy Manager are:
Access Policy events
Access Policy event messages include logs pertinent to access policy, sso, network access, and web applications. To view access policy events, on the navigation pane, expand System, and click Logs
Audit Logging
Audit event messages are those that the Access Policy Manager system logs as a result of changes made to its configuration.
For more information on other log events, refer to the BIG-IP® Configuration Guide for Local Traffic Manager, on the Ask F5SM web site, https://support.f5.com.
Introducing logging features
The logging mechanism on an Access Policy Manager system includes several features designed to keep you informed of system events in the most effective way possible.
One of the primary features of logging is its ability to log different types of events, ranging from system events to access control events. Through the Access Policy Manager system auditing feature, you can even track and report changes that administrator makes to the BIG-IP® system configuration, such as adding a virtual server or changing an access policy. For more information, see Understanding log content, and Understanding log types.
When setting up logging on the Access Policy Manager, you can customize the logs by designating the minimum severity level, or log level, that you want the system to report when a type of event occurs. The minimum log level indicates the minimum severity level at which the system logs that type of event.
For examples of log levels, refer to Setting log levels.
You can also use the Configuration utility to search for a string within a log event, that is, you can filter the display of the log messages according to the string you provide. For more information, see Setting log levels.
Tip: You can also configure the system to send email or to activate pager notification based on the priority of the logged event.
Note: Files are rotated daily if their size exceeds 10MB. Additionally, weekly rotations are enforced if the rotated log file is a week old, regardless whether or not the file exceed the 10MB threshold.
Understanding log content
The logs that the system generates include several types of information. For example, all logs show a timestamp, host name, and service for each event. Some logs show a status code, while the audit log shows a user name and a transaction ID corresponding to each configuration change. All logs can contain up to two-line descriptions of each event.
Table 11-1, following, displays the categories of information contained in the logs, and the specific logs in which the information is displayed
.
Table 17.1 Log information categories and their descriptions
Information Type
Explanation
Log Type
Timestamp
The time and date that the system logged the event message.
System
Access Policy
Audit
Log Level
Provides log level detail for each message.
Access Policy
Host
The host name of the system that logged the event message. Because this is typically the host name of the local machine, the appearance of a remote host name could be of interest.
System
Service
The service that generated the event.
System
Status code
The status code associated with the event. Note that only events logged by BIG-IP system components, and not operating system services, have status codes.
Access Policy
Session ID
The ID associated with the user session.
Access Policy
Description
The description of the event that caused the system to log the message.
System
User Name
The name of the user who made the configuration change.
Audit
Transaction
The identification number of the configuration change.
Audit
Event
Provides the description of the event so that it can be applicable to both Audit and Access policy logging.
Audit
Access Policy
Note: For standalone clients, once a user has logged out and then logged back in, the sessions ID will be displayed as invalid and will remain as such in the Notice logs. The user is then assigned a new session ID. This is expected behavior of the system.
Understanding log types
The Access Policy Manager automatically logs two main event types:
Access policy: Includes messages created during access policy validation, sso, network access, and web applications.
Audit: Includes configuration changes.
Each type of event is stored in a log file, and the information stored in each log file varies depending on the event type.
Access policy events. Messages are logged in the var/log/apm file.
Audit events. Messages are logged in the var/log/audit file.
Logging system events
Many events that occur on Access Policy Manager are operating system-related events, and do not specifically apply to the Access Policy Manager. The Access Policy Manager logs the messages for these events in the file /var/log/messages.
Using the Configuration utility, you can display these system messages. On the navigation pane, expand System, click Logs, and choose System. Table 17.2 shows some sample system log entries.
Table 17.2 Sample system log entries
Auditing configuration changes
Audit logging is an optional feature that logs messages whenever there are changes made by the system. Such changes include the following items:
User action
System action
Loading configuration data
The Access Policy Manager logs the messages for these auditing events in the /var/log/audit file.
Using the Configuration utility, you can display audit log messages. Table 17.3 shows some sample audit log entries. In this example, the first entry shows that user Janet enabled the audit logging feature, while the second and third entries show that user Matt designated the BIG-IP system to be a redundant system with a unit ID of 1.
Table 17.3 Sample audit log entries
Timestamp
User Name
Transaction
Event
Mon Feb 14 03:34:45 PST 2008
janet
DB_VARIABLE modified:
name="config.auditing"
Mon Feb 14 03:35:06 PST 2008
matt
DB_VARIABLE modified:
name="failover.isredundant"
value="true"
Mon Feb 14 03:35:06 PST 2008
matt
DB_VARIABLE modified:
name="failover.unitid"
value="1"
By default, audit logging is disabled. For information on enabling this feature, see Setting log levels, following.
Setting log levels
Using the Configuration utility, you can set log levels on auditing events and other types of events. The minimum log level indicates the minimum severity level at which the system logs that type of event. For more information, see To set a minimum log level for local traffic events, following.
For auditing events, you can set a log level that indicates the type of event that the system logs, such as the user-initiated loading of the Access Policy Manager system configurations, or system-initiated configuration changes. For more information, see Setting log levels for auditing events.
To set the log level
1.
On the navigation pane, expand System, and click Logs.
The Logs screen opens.
2.
On the menu bar, click Options.
The Logs screen changes to display the various logging options available.
3.
Depending on the type of log messages you want to control, select either Access Policy Logging or Audit Logging.
4.
Select the log level for the selected component, and click Update.
The log levels that you can set on certain types of events, are sequenced from highest severity to lowest severity, like this:
Emergency
Alert
Critical
Error
Warning
Notice
Informational
Debug
To set a minimum log level for local traffic events
1.
On the navigation pane, expand System, and click Logs.
The Logs screen opens.
2.
On the menu bar, click Options.
The screen for setting minimum log levels opens.
3.
Select a minimum log level from the list.
4.
Click Update.
To view the access policy log messages
Once you select your logging options, you can view your log levels
1.
On the navigation pane, expand System, and click Logs.
The Logs screen opens.
2.
On the menu bar, click Access Policy.
This displays log levels specific to access policy manager modules.
3.
If you want to advance to another screen of messages, first locate the page list at the lower-right corner of the screen. You can either:
Display the list and select a page number.
Click the right arrow to advance to the next page of messages.
To filter log messages based on a search string
1.
On the navigation pane, expand System, and click Logs.
The Logs screen opens.
2.
On the menu bar, click Access Policy.
3.
In the Search box (directly above the Timestamp column), type a string, optionally using the asterisk as a wildcard character.
4.
Click Search.
The screen refreshes and displays only those messages containing the string you specified.
Setting log levels for auditing events
An optional type of logging that you can enable is audit logging. Audit logging provides options to control audit logging at the MCP level and at the BIGIP level. This logs audit messages for administrators who perform operations at the user interface level and also through command line interface.
For more information, see Auditing configuration changes.
For detailed information about auditing events, refer to the BIG-IP® Configuration Guide for Local Traffic Manager, on the Ask F5SM web site, https://support.f5.com.
You can choose one of four log levels for audit logging. In this case, the log levels do not affect the severity of the log messages; instead, they affect the initiator of the audit event.
The log levels for audit logging are:
Disable
This turns audit logging off. This is the default value.
Enable
This causes the system to log messages for user-initiated configuration changes only.
Verbose
This causes the system to log messages for user-initiated configuration changes and any loading of configuration data.
Debug
This causes the system to log messages for all user-initiated and system-initiated configuration changes.
To set a minimum log level for audit events
1.
On the navigation pane, expand System, and click Logs.
This Logs screen opens.
2.
On the menu bar, click Options.
This displays the screen for setting minimum log levels on local traffic events.
3.
In the Audit Logging area near the bottom of the screen, select a log level from the Audit list, which includes MCP and bigpipe.
4.
Click Update.
You can find additional information about logging in Logging BIG-IP Systems Events of the BIG-IP® Configuration Guide for Local Traffic Manager, on the Ask F5SM web site, https://support.f5.com.
Understanding reports
You can review reports about the sessions created on the system. With Access Policy Manager, you can view either Current Sessions or All Sessions. Under Current Sessions, you can configure your settings to display according to your sessions Table 17.4 displays the information type of the report and its descriptions.
Displaying reports for current sessions
You can display all current active sessions that are running on the system. Additionally, you can set options to update session information every few seconds, and refresh the session table at any given time.
To change your display options
1.
On the navigation pane, expand Access Policy, and click Reports.
2.
On the menu bar, click Current Sessions.
3.
From the Auto Refresh list, select the time interval (in seconds) to refresh the session table. It is disabled by default.
4.
To manually refresh the table, click Refresh Session Table.
Displaying session variables for current sessions
You can view session variables for all current sessions.
To display session variable for current sessions
1.
On the navigation pane, expand Access Policy, and click Reports.
2.
On the menu bar, click Current Sessions.
3.
Click the short variable name to display the full variable name.
4.
Click Expand Tree to view all session variables at once.
The following information is displayed for all sessions:
Session Summary
Session Start
Remote Host
Virtual Server (to which user are connected)
Logon
Status
Access Policy Logs
Session Variables tab
Packet Filter tab
The table, following, explains the type of information displayed for each session.
 
Table 17.4 Reporting information types
Information Type
Explanation
Status
The status of the session.
Session ID
The Session ID of each session.
Logon
The Logon name used to start a session
Client IP
The IP address of the client machine that the user connects from.
Start Time
The Start time of each session
Expiration
The time at which the session is expected to time out.
Bytes In
The total number of bytes received by the session.
Bytes Out
The total number of bytes transmitted by the session.
Terminating user sessions
You can terminate selected user sessions that are running on the system for troubleshooting and security purposes. For example, you may find that you need to perform certain troubleshooting tasks on one or multiple user sessions. Or, you notice that there are security issues and need to terminate user sessions immediately for further investigation. Access Policy Manager provides you with the ability to terminate user sessions immediately.
To terminate user sessions
1.
On the navigation pane, expand Access Policy, and click Reports.
This navigates to the current session page.
2.
Select one or more user sessions, and click Kill Selected Sessions.
The active sessions no longer appear in the active session list.
Displaying reports for all sessions
You can display detailed information for all active and previously terminated sessions running on the system. Each session contains a session ID that you can click to navigate to a screen which provides more detailed information for each session.
To display information on all sessions
1.
On the navigation pane, expand Access Policy, and click Reports.
The Report screen opens.
2.
On the menu bar, click All Sessions.
A more detailed screen opens for all sessions running on the system.
3.
To view detailed information per session, click a Session ID.
A Session Summary screen opens.
Using scripts to view reports
In addition to viewing the reports through the navigation pane, you can also use the command line interface and script, called adminreport.pl to view additional reports, such as acllogs, logonlogs, acllogsforsession, and saforsession.
To view additional reports and logs from the command line
1.
From the command line, type adminreports.pl.
2.
Depending on the type of logs you want to view, type the following in the command line:
adminreports.pl -aclogs
adminreports.pl -logonlogs
adminreports.pl -aclogsforsession session_id
adminreports.pl -saforsession session_id
adminreports.pl -count
adminreports.pl -start <index>
adminreports.pl -end <index>
Table 17.5 lists the available command line utility commands and their descriptions.
 
Table 17.5 Command line to view additional reports
Command
Description
-aclogs
This displays the access control log messages.
-logonlogs
This returns logon log messages.
-aclogsforsession session_id
This returns access control logs for the given session id <sid>/.
-saforsession <sid>
This returns session activity information to the given session id <sid>.
-count
This returns the number of entries in access control and logon logs.
-start <index>
This returns entries starting from the given <index>. The default is the first entry <index is 1>/
-end <index>
This returns entries until the given <index>. The default is the last entry.
-help
Prints the onscreen message.
Viewing statistics
You can use the Access Policy Manager to view statistics for both Access Profile and Secure Connectivity. You can view the stats for any given access profile or for all access profiles (cumulative).
The following table display the type of statistics supported by Access Policy Manager. The table also includes information on whether statistic objects are accessible by command line or by SNMP.
Session statistics
Session statistics are based on user sessions.
 
Table 17.6 Session statistics
Statistics Object
Description
GUI
CLI
SNMP
TotalActiveSessions
Total number of active sessions (Pending+Validated, Validated alone)
Y
Y
Y
MaxActiveSessions
Maximum number of active sessions since the system up-time
N
Y
Y
ValidatedActiveSessions
Total number of active sessions completed validation
Y
Y
Y
PendingActiveSessions
Total number of active sessions on-going validation
Y
Y
Y
Access policy result statistics
Access policy result statistics are based on the results of access policy validation, and timeout/error conditions.
 
Table 17.7 Access Policy result statistics
Statistics Object
Description
GUI
CLI
SNMP
AllowSessions
Total number of user sessions reached allow ending
Y
Y
Y
DenySessions
Total number of user sessions reached deny ending
Y
Y
Y
ErrroredSessions
Total number of user sessions terminated due to internal errors
Y
Y
Y
TimedoutSessions
Total number of user sessions terminated due to timeouts
Y
Y
Y
AllowTimedoutSessions
Total number of user sessions terminated due to allow timeouts
Y
Y
Y
AdminTerminatedSessions
Total number of user sessions terminated by Admin
Y
Y
Y
UserLoggedoutSessions
Total number of user sessions terminated due to user logout
Y
Y
Y
MiscTerminated Sessions
Total number of user sessions terminated due to other reasons (Cache Cleaner, etc)
Y
Y
Y
Agent type statistics
Agent type statistics are based on the APD agent types such as anti-virus check, file check, registry check, windows info, client certificate check, and RADIUS/LDAP/AD/RSA authentication checks.
 
Table 17.8 Agent type statistics
Statistics Object
Description
GUI
CLI
SNMP
DenyendingAgent
Agent
Y
Y
Y
AllowendingAgent
Agent
Y
Y
Y
RedirectendingAgent
Agent
Y
Y
Y
allowAgent
Agent
Y
Y
Y
EPSProtectedWorkspace
Agent
Y
Y
Y
EPSOsInfo
Agent
Y
Y
Y
EPSFileCheck
Agent
Y
Y
Y
EPSFwCheck
Agent
Y
Y
Y
EPSProcCheck
Agent
Y
Y
Y
EPSRegCheck
Agent
Y
Y
Y
EPSLinuxfilecheck
Agent
Y
Y
Y
EPSLinuxprocescheck
Agent
Y
Y
Y
EPSMacfilecheck
Agent
Y
Y
Y
EPSMacprocesscheck
Agent
Y
Y
Y
EPSWindowsbrowsercachecleaner
Agent
Y
Y
Y
EPSWindowsgrouppolicy
Agent
Y
Y
Y
EPSWindowscmachinecertcheck
Agent
Y
Y
Y
externalLogon
Agent
Y
Y
Y
variableAssign
Agent
Y
Y
Y
routeDomainSelection
Agent
Y
Y
Y
LogonpageAgent
Agent
Y
Y
Y
VLANAgent
Agent
Y
Y
Y
LoggingAgent
Agent
Y
Y
Y
ActiveDirectoryAgent
Agent
Y
Y
Y
LDAPAgent
Agent
Y
Y
Y
RADIUSAgent
Agent
Y
Y
Y
RADIUSAccountingAgent
Agent
Y
Y
Y
securIDAgent
Agent
Y
Y
Y
HTTPAgent
Agent
Y
Y
Y
clientcertAgent
Agent
Y
Y
Y
EPS cache cleaner
Agent
Y
Y
Y
EPS Antivirus
Agent
Y
Y
Y
ResoureAssignment
Agent
Y
Y
Y
DecisionBox
Agent
Y
Y
Y
MessageBox
Agent
Y
Y
Y
The following statistics objects are supported for each agent type.
Table 17.9 Supported statistics objects for agent types
Statistics Object
Description
GUI
CLI
SNMP
TotalInstances
Number of instances of a specific agent type in the access policy
Y
Y
Y
TotalUsages
Total number of times the specific agent was used
Y
Y
Y
TotalSuccesses
Total number of success conditions created/reached by the agent
Y
Y
Y
TotalErrors
Total number of error conditions created/reached by the agent
Y
Y
Y
TotalSessionVariables
Total number of session variables created by the agent
Y
Y
Y
Global profile access statistics
Global access statistics are applicable to your global settings.
 
Table 17.10 Global Profile Access statistics
Stats Object
Description
GUI
CLI
SNMP
TotalSessions
The total sessions created in the system
Y
Y
Y
TotalEstablishedSessions
The total established sessions in the system
Y
Y
Y
CurrentActiveSessions
The total active user sessions in the system
Y
Y
Y
CurrentPendingSessions
The total user sessions going through access policy evaluation in the system
Y
Y
Y
CurrentEstablishedSessions
The total user sessions that have completed access policy evaluation in the system
Y
Y
Y
MiscTerminatedSessons
The total aggregated sessions terminated due to timeout or error (any kind).
Y
Y
Y
UserLoggedoutSessions
The total packets transmitted by the network tunnel in the system
Y
Y
Y
AdminTerminatedSessions
The total sessions timed out in the access policy evaluation phase and network access connection phase in the system.
Y
Y
Y
AllowEnding
The total sessions that resulted in allow in the system
Y
Y
Y
ResultDeny
The total sessions that resulted in access deny in the system
Y
Y
Y
ResultRedirect
The total sessions that resulted in redirect ending in the system
Y
Y
Y
ResultRedirectWithSession
The total sessions that resulted in redirect ending with sessions in the system
Y
Y
Y
PPP global statistics
PPP global statistics provide cumulative statistics for all the PPP connections, such as the total number of PPP connections created, or number of bytes received/transmitted.
 
Table 17.11 PPP global statistics
Statistics Object
Description
GUI
CLI
TotLinks
The total PPP sessions in the system
Y
Y
CurLinks
The total current PPP sessions in the system
Y
Y
MaxLinks
The maximum PPP sessions allowed in the system
Y
Y
RxBytes
The total number of bytes received by PPP in the system
Y
Y
TxBytes
The total number of bytes transmitted by PPP in the system
Y
Y
RxFrames
The total packets received by PPP in the system
Y
Y
TxFramess
The total packets transmitted by PPP in the system
Y
Y
RxErrors
The total number of packets with errors received by PPP in the system
Y
Y
TxErrors
The total number of packets with errors transmitted by PPP in the system
Y
Y
Session info (access info) statistics
Session statistics provide session level information for all active sessions in the system. The information includes things like display session ID, client IP, start/expiration time, byte/packet count, logon details, and session status.
 
Table 17.12 Session info statistics
Statistics Object
Description
GUI
CLI
SNMP
Access Status
Status of the sessions (established, pending, unspecified)
Y
Y
N
Logon
Logon name
Y
Y
N
Client IP
The IP address of the machine in which the user is connected.
 
 
 
Start Time
The session start time
Y
Y
N
Expiration Time
The expiration time of the session
Y
Y
N
RxBytes
Total bytes received in the network access connection
Y
Y
N
TxBytes
Total bytes transmitted in the network access connection
Y
Y
N
RxPackets
Total packets received in the network access connection
Y
Y
N
TxPackets
Total packets transmitted in the network access connection
Y
Y
N
ingress (raw)
These determine compression ratios.
Y
Y
N
ingress (compressed)
These determine compression ratios.
Y
Y
N
egress (raw)
These determine compression ratios.
Y
Y
N
egress (compressed)
These determine compression ratios.
Y
Y
N
Monitoring system and user information
You can monitor overall system performance and Access Policy Manager session information. The BIG-IP® system provides a dashboard that displays system statistics graphically, showing gauges and graphs, and you can view the same statistics in a table view. You can also view user session information specific to Access Policy Manager.
You can display the BIG-IP® system main dashboard from the navigation pane. Expand Overview, and click Dashboard tab. For more information on how to monitor overall system performance for the BIG-IP® system, refer to Getting Started Guide: BIG-IP®systems.
The dashboard also includes online help for information about how to interpret statistics on each of the panels that appear on the screens. Click the question mark (?) in the upper right corner of any window to display the online help.
Viewing the Access Policy Manager dashboard
In addition to the BIG-IP® system main dashboard, you can use the Access Policy Manager dashboard to view specific Access Policy Manager users session-based statistics, as well as throughput data.
With the Access Policy Manager dashboard, you can view the following information in four distinct panels:
Active and new sessions
Network access open and new connections
Web application cache information
Access control list transactions
To view the dashboard, on the navigation pane, expand Access Policy, and click Dashboard.
Tip: By clicking the grid icon in the upper left corner of each window, you can display the same information in a table format.
Monitoring active and new sessions
The top left panel of the Access Policy Manager dashboard displays the total and established connections for all current active and new sessions. This panel is called Access Sessions.
There are two tabs available for this panel:
Active Sessions: Displays the number of active sessions.
New Sessions: Displays the number of new sessions
You can view them in either real-time, or historical time ranges. You may want to view active sessions at various times of the day to determine the peak and select the best time to perform system maintenance, for example. If you notice that the total number of sessions peaked while the total number of established sessions remain low, this may be an indication that a possible malicious attack is occurring in your network environment.
Monitoring web applications cache information
The bottom left panel of the Access Policy Dashboard displays cache effectiveness by comparing the three available metrics. This panel is called Web Applications. There are currently no tabs available for this panel, but the metrics include:
Client Requests: Displays the total cache requests from the client.
Request Served from RamCache: Displays the total number of cache hits.
Requests Missed from RamCache: Displays the total number of cache misses.
Hits and misses are derived by substracting the server responses from the client responses. A server response indicates that the requested information was not in cache.
Monitoring network access throughput and connections
The right top panel of the Access Policy dashboard displays throughput data for the amount of traffic through the network access tunnels, as well as displays open and new connections. This panel is called Network Access.
You can view throughput numbers to and from the client, as well as the overall throughput for network access traffic.
Use this panel to determine how much traffic is going through the tunnels, and how many people are generating that traffic. For example, if there are two tunnels, and those particular users are generating gigabytes of traffic, you may want to further investigate the activities on those tunnels.
This panel is also useful as a good indicator for peaked traffic to determine the best time to perform system maintenance
There are four tabs available for this panel:
Throughput: Displays the amount of throughput for data transfers through the network access tunnels.
Open Connections: Displays the number of open connections through the network access tunnels.
New Connections: Displays the number of new connections through the network access tunnels.
Compression: Displays the compression level through the network access tunnel. The Compression tab provides a gauge as well as a chart.
Monitoring access control list information
The bottom right panel of the Access Policy Dashboard displays ACL activities.
There is one tab available for this panel:
ACL Actions: Displays the action that the access control list takes when an access control entry is encountered.
Table of Contents   |   << Previous Chapter   |   Next Chapter >>

Was this resource helpful in solving your issue?




NOTE: Please do not provide personal information.



Incorrect answer. Please try again: Please enter the words to the right: Please enter the numbers you hear:

Additional Comments (optional)