Applies To:

Show Versions Show Versions

Manual Chapter: Logging and Reporting
Manual Chapter
Table of Contents   |   << Previous Chapter   |   Next Chapter >>

14 
Viewing and maintaining log messages is an important part of maintaining the Access Policy Manager. Log messages inform you on a regular basis of the events that are happening on the system. Some of these events pertain to general events happening within the system, while other events are specific to the Access Policy Manager, such as stopping and starting Access Policy Manager system services.
The Access Policy Manager uses syslog-ng to log events. The syslog-ng utility is an enhanced version of the standard logging utility syslog.
Access Policy events
Access Policy event messages include logs pertinent to access policy, sso, network access, and portal access. To view access policy events, run Access Policy reports; expand Access Policy and click Reports.
Audit Logging
Audit event messages are those that the Access Policy Manager system logs as a result of changes made to its configuration.
For more information on other log events, refer to the BIG-IP® Configuration Guide for Local Traffic Manager, on the Ask F5TM web site at http://support.f5.com.
The logging mechanism on an Access Policy Manager system includes several features designed to keep you informed of system events in the most effective way possible.
One of the primary features of logging is its ability to log different types of events, ranging from system events to access control events. Through the Access Policy Manager system auditing feature, you can even track and report changes that administrator makes to the BIG-IP® system configuration, such as adding a virtual server or changing an access policy. For more information, see Understanding log content, and Understanding log types.
When setting up logging on the Access Policy Manager, you can customize the logs by designating the minimum severity level, or log level, that you want the system to report when a type of event occurs. The minimum log level indicates the minimum severity level at which the system logs that type of event.
Tip: You can also configure the system to send email or to activate pager notification based on the priority of the logged event.
Note: Files are rotated daily if their size exceeds 10MB. Additionally, weekly rotations are enforced if the rotated log file is a week old, regardless whether or not the file exceed the 10MB threshold.
The logs that the system generates include several types of information. For example, all logs show a timestamp, host name, and service for each event. Some logs show a status code, while the audit log shows a user name and a transaction ID corresponding to each configuration change. All logs can contain up to two-line descriptions of each event.
Table 14.1, following, displays the categories of information contained in the logs, and the specific logs in which the information is displayed.
System
Access Policy
Audit
The host name of the system that logged the event message. Because this is typically the host name of the local machine, the appearance of a remote host name could be of interest.
The status code associated with the event. Note that only events logged by BIG-IP system components, and not operating system services, have status codes.
Audit
Access Policy
Note: For standalone clients, once a user has logged out and then logged back in, the sessions ID will be displayed as invalid and will remain as such in the Notice logs. The user is then assigned a new session ID. This is expected behavior of the system.
Access policy: Includes messages created during access policy validation, sso, network access, and portal access.
Audit: Includes configuration changes.
Access policy events: Messages are logged in the var/log/apm file.
Audit events: Messages are logged in the var/log/audit file.
Many events that occur on Access Policy Manager are operating system-related events, and do not specifically apply to the Access Policy Manager. The Access Policy Manager logs the messages for these events in the file /var/log/messages.
Using the Configuration utility, you can display these system messages. On the navigation pane, expand System, click Logs, and choose System.
Audit logging is an optional feature that logs messages whenever there are changes made by the system. Such changes include the following items:
Using the Configuration utility, you can display audit log messages. Table 14.2 shows some sample audit log entries. In this example, the first entry shows that user Janet enabled the audit logging feature, while the second and third entries show that user Matt designated the BIG-IP system to be a redundant system with a unit ID of 1.
DB_VARIABLE modified:
name="config.auditing"
DB_VARIABLE modified:
name="failover.isredundant"
value="true"
DB_VARIABLE modified:
name="failover.unitid"
value="1"
Using the Configuration utility, you can set log levels on auditing events and other types of events. The minimum log level indicates the minimum severity level at which the system logs that type of event. For more information, see To set a minimum log level for local traffic events, following.
For auditing events, you can set a log level that indicates the type of event that the system logs, such as the user-initiated loading of the Access Policy Manager system configurations, or system-initiated configuration changes. For more information, see Setting log levels for auditing events.
1.
On the navigation pane, expand System, click Logs.
The Logs screen opens.
2.
On the menu bar, click Configuration, and select Options.
The Logs screen changes to display the various logging options available.
The log levels that you can set on certain types of events, are sequenced from highest severity to lowest severity, like this:
1.
On the navigation pane, expand System, and click Logs.
The Logs screen opens.
2.
On the menu bar, click Configuration, and select Options.
The Logs screen changes to display the various logging options available.
3.
Scroll down to Local Traffic Logging.
An optional type of logging that you can enable is audit logging. Audit logging provides options to control audit logging at the MCP level and at the tmsh level. This logs audit messages for administrators who perform operations at the user interface level and also through command line interface.
For detailed information about auditing events, refer to the BIG-IP® Configuration Guide for Local Traffic Manager, on the Ask F5TM web site at http://support.f5.com.
You can choose one of four log levels for audit logging. In this case, the log levels do not affect the severity of the log messages; instead, they affect the initiator of the audit event.
Disable
This turns audit logging off. This is the default value.
Enable
This causes the system to log messages for user-initiated configuration changes only.
Verbose
This causes the system to log messages for user-initiated configuration changes and any loading of configuration data.
Debug
This causes the system to log messages for all user-initiated and system-initiated configuration changes.
1.
On the navigation pane, expand System, and click Logs.
This Logs screen opens.
2.
On the menu bar, click Configuration and select Options.
3.
In the Audit Logging area near the bottom of the screen, select a log level from the Audit Logging list, which includes MCP and tmsh.
4.
Click Update.
You can find additional information about logging in Logging BIG-IP Systems Events of the BIG-IP® Configuration Guide for Local Traffic Manager, on the Ask F5TM web site at http://support.f5.com.
You can review reports about the sessions created on the system. With Access Policy Manager, you can view either Current Sessions or All Sessions.
1.
On the navigation pane, expand Access Policy and click Reports.
2.
From the Reports Browser Session Reports, click Current Sessions and select Run.
You can display detailed information for all active and previously terminated sessions running on the system. Each session contains a session ID that you can click to navigate to a screen which provides more detailed information for each session.
1.
On the navigation pane, expand Access Policy, and click Reports.
The Report screen opens.
2.
From the Reports Browser Session Reports, click All Sessions and select Run.
A more detailed screen opens for all sessions running on the system.
3.
To view detailed information per session, click a Session ID.
A Session Details tab opens.
In addition to viewing the reports through the navigation pane, you can also use the command line interface and script, called adminreport.pl to view additional reports, such as acllogs, logonlogs, acllogsforsession, and saforsession.
1.
2.
Depending on the type of logs you want to view, type the following in the command line:
adminreports.pl -aclogs
adminreports.pl -logonlogs
adminreports.pl -aclogsforsession session_id
adminreports.pl -saforsession session_id
adminreports.pl -count
adminreports.pl -start <index>
adminreports.pl -end <index>
Table 14.3 lists the available command line utility commands and their descriptions.
You can monitor overall system performance and Access Policy Manager session information. The BIG-IP® system provides a dashboard that displays system statistics graphically, showing gauges and graphs, and you can view the same statistics in a table view. You can also view user session information specific to Access Policy Manager.
You can display the BIG-IP® system main dashboard from the navigation pane. Expand Overview, and click Dashboard tab. For more information on how to monitor overall system performance for the BIG-IP® system, refer to Getting Started Guide: BIG-IP®systems.
The dashboard also includes online help for information about how to interpret statistics on each of the panels that appear on the screens. Click the question mark (?) in the upper right corner of any window to display the online help.
In addition to the BIG-IP® system main dashboard, you can use the Access Policy Manager dashboard to view specific Access Policy Manager users session-based statistics, as well as throughput data.
Tip: By clicking the grid icon in the upper left corner of each window, you can display the same information in a table format.
The top left panel of the Access Policy Manager dashboard displays the total and established connections for all current active and new sessions. This panel is called Access Sessions.
Active Sessions: Displays the number of active sessions.
New Sessions: Displays the number of new sessions
You can view them in either real-time, or historical time ranges. You may want to view active sessions at various times of the day to determine the peak and select the best time to perform system maintenance, for example. If you notice that the total number of sessions peaked while the total number of established sessions remain low, this may be an indication that a possible malicious attack is occurring in your network environment.
The bottom left panel of the Access Policy Dashboard displays cache effectiveness by comparing the three available metrics. This panel is called Portal Access. There are currently no tabs available for this panel, but the metrics include:
Client Requests: Displays the total cache requests from the client.
Request Served from RamCache: Displays the total number of cache hits.
Requests Missed from RamCache: Displays the total number of cache misses.
Hits and misses are derived by subtracting the server responses from the client responses. A server response indicates that the requested information was not in cache.
The right top panel of the Access Policy dashboard displays throughput data for the amount of traffic through the network access tunnels, as well as displays open and new connections. This panel is called Network Access.
Use this panel to determine how much traffic is going through the tunnels, and how many people are generating that traffic. For example, if there are two tunnels, and those particular users are generating gigabytes of traffic, you may want to further investigate the activities on those tunnels.
Throughput: Displays the amount of throughput for data transfers through the network access tunnels.
Open Connections: Displays the number of open connections through the network access tunnels.
New Connections: Displays the number of new connections through the network access tunnels.
Compression: Displays the compression level through the network access tunnel. The Compression tab provides a gauge as well as a chart.
ACL Actions: Displays the action that the access control list takes when an access control entry is encountered.
Table of Contents   |   << Previous Chapter   |   Next Chapter >>

Was this resource helpful in solving your issue?




NOTE: Please do not provide personal information.



Incorrect answer. Please try again: Please enter the words to the right: Please enter the numbers you hear:

Additional Comments (optional)