| My Support

Applies To:

Show Versions Show Versions
Manual Chapter: Logging and Reporting
Manual Chapter
Table of Contents   |   << Previous Chapter   |   Next Chapter >>

13 
 
Logging and Reporting
Understanding logging
Understanding log types
Setting log levels
Understanding reports
Monitoring system and user information
Understanding logging
Viewing and maintaining log messages is an important part of maintaining the Access Policy Manager. Log messages inform you on a regular basis of the events that are happening on the system. Some of these events pertain to general events happening within the system, while other events are specific to the Access Policy Manager, such as stopping and starting Access Policy Manager system services.
The Access Policy Manager uses syslog-ng to log events. The syslog-ng utility is an enhanced version of the standard logging utility syslog.
The type of events messages available on the Access Policy Manager are:
Access Policy events
Access Policy event messages include logs pertinent to access policy, sso, network access, and portal access. To view access policy events, run Access Policy reports; expand Access Policy and click Reports.
Audit Logging
Audit event messages are those that the Access Policy Manager system logs as a result of changes made to its configuration.
For more information on other log events, refer to BIG-IP® TMOS®: Concepts on the Ask F5TM web site, http://support.f5.com.
Introducing logging features
The logging mechanism on an Access Policy Manager system includes several features designed to keep you informed of system events in the most effective way possible.
One of the primary features of logging is its ability to log different types of events, ranging from system events to access control events. Through the Access Policy Manager system auditing feature, you can even track and report changes that administrator makes to the BIG-IP® system configuration, such as adding a virtual server or changing an access policy. For more information, see Understanding log content, and Understanding log types.
When setting up logging on the Access Policy Manager, you can customize the logs by designating the minimum severity level, or log level, that you want the system to report when a type of event occurs. The minimum log level indicates the minimum severity level at which the system logs that type of event.
For examples of log levels, refer to Setting log levels.
Tip: You can also configure the system to send email or to activate pager notification based on the priority of the logged event.
Understanding log content
The logs that the BIG-IP system generates include several types of information. For example, some logs show a timestamp, host name, and service for each event. Moreover, logs sometimes include a status code, while the audit log shows a user name and a transaction ID corresponding to each configuration change. All logs contain an up to 2-line description of each event.
Table 13.1, following, displays the categories of information contained in the logs, and the specific logs in which the information is displayed.
 
Table 13.1 Log information categories and their descriptions 
Information Type
Explanation
Log Type
Timestamp
The time and date that the system logged the event message.
System
Access Policy
Audit
Log Level
Provides log level detail for each message.
Access Policy
Host
The host name of the system that logged the event message. Because this is typically the host name of the local machine, the appearance of a remote host name could be of interest.
System
Service
The service that generated the event.
System
Status code
The status code associated with the event. Note that only events logged by BIG-IP system components, and not operating system services, have status codes.
Access Policy
Session ID
The ID associated with the user session.
Access Policy
Description
The description of the event that caused the system to log the message.
System
User Name
The name of the user who made the configuration change.
Audit
Transaction
The identification number of the configuration change.
Audit
Event
Provides the description of the event so that it can be applicable to both Audit and Access policy logging.
Audit
Access Policy
Note: For standalone clients, once a user has logged out and then logged back in, the sessions ID will be displayed as invalid and will remain as such in the Notice logs. The user is then assigned a new session ID. This is expected behavior of the system.
Modifying settings for the log database
By default, Access Policy Manager writes logs to a database and to the /var/log/apm file. Access Policy Manager reports run against the data in the database. You can: Specify how frequently to remove the oldest logs from the database; Control the maximum number of log entries that the database can hold; Remove all existing log records
When log database tables are rotated, the oldest database table is dropped.
To control database log rotation and maximum log entries
1.
From the Main tab, select Access Policy > Reports > Preferences.
The Preferences window opens.
2.
In the Log Rotation Period box, type a number between 0 and 90. The default value is 0.
When set to 0, log database tables are rotated only when the database contains the maximum number of log entries.
When set to a value between 1 and 90, log database tables are rotated every n number of days. (If the maximum number of log entries is reached despite regular rotation, log database tables are rotated regardless.)
3.
In the Maximum Number Of Log Entries box, type a number between 100000 and 5000000 (100,000 and 5,000,000). Do not type commas. The default value is 5000000.
4.
Click Update.
To remove all log data from the database
1.
From the Main tab, select Access Policy > Reports > Preferences.
The Preferences window opens.
2.
Next to Log Database Maintenance, click Delete.
All records are deleted from the reporting log database.
Modifying settings for the log file
In addition to logging to a database, Access Policy Manager logs to the /var/log/apm file. You might need the log file to help you troubleshoot a problem. If you configured logging to a remote server, you need Access Policy Manager to write to the log file for remote logging to work.
If you do not need or directly use the log file (for example, by searching them), you can stop Access Policy Manager from writing it.
To configure APM to log to the database only
1.
From the Main tab, select Access Policy > Reports > Preferences.
The Preferences window opens.
2.
Clear the Enabled box for Write To APM Log File.
3.
Click Update.
Note: When Write To APM Log File is enabled, by default the file is rotated daily regardless of size.
When running performance tests or under a very high traffic load, the /var/log/apm file can grow very large. While testing and otherwise, when a very high traffic load persists, you can mitigate the effect by disabling logging to /var/log/apm/ or by setting the log level to emergency only.
To disable logging to file for performance test or high traffic load
1.
Type this command:
tmsh modify sys db log.access.syslog value disable
To set log level to emergency for performance test or high traffic load
1.
Type this command:
tmsh modify sys db log.accesscontrol.level value emergency
To configure log rotation for the BIG-IP system
To configure log rotation for the BIG-IP system, use the tmsh sys log-rotate command. For more information about tmsh, refer to the Traffic Management Shell (tmsh) Reference Guide. You can also use the man pages for tmsh.
For more information about managing log files on the BIG-IP system, refer to http://support.f5.com.
About configuring logging to a remote server
To configure remote logging, use the tmsh modify /sys syslog remote-servers command. For more information about the command, refer to the Traffic Management Shell (tmsh) Reference Guide. You can also use the man pages for tmsh.
Note: The default syslog levels defined for the BIG-IP system logs apply to local logs only; all syslog messages are sent to remote syslog servers.
For information about filtering syslog messages sent to remote syslog servers, refer to http://support.f5.com.
Understanding log types
The Access Policy Manager can log two main event types:
Access policy: Includes messages created during access policy validation, sso, network access, and portal access.
Audit: Includes configuration changes.
You can view log information through the user interface or in log files.
Access policy events: Messages are logged in a database; you can view them using Access Policy Manager reports. By default, messages are also logged to the /var/log/apm file.
Audit events: Messages are logged in the /var/log/audit file when audit logging is enabled.
Logging system events
Many events that occur on Access Policy Manager are operating system-related events, and do not specifically apply to the Access Policy Manager. The Access Policy Manager logs the messages for these events in the /var/log/messages file.
Using the Configuration utility, you can display these system messages. On the navigation pane, expand System, click Logs, and choose System.
Auditing configuration changes
Audit logging is an optional feature that logs messages whenever there are changes made by the system. Such changes include the following items:
User action
System action
Loading configuration data
The Access Policy Manager logs the messages for these auditing events in the /var/log/audit file.
Using the Configuration utility, you can display audit log messages. Table 13.2 shows some sample audit log entries. In this example, the first entry shows that user Janet enabled the audit logging feature, while the second and third entries show that user Matt designated the BIG-IP system to be a redundant system with a unit ID of 1.
Table 13.2 Sample audit log entries
Timestamp
User Name
Transaction
Event
Mon Feb 14 03:34:45 PST 2008
janet
DB_VARIABLE modified:
name=config.auditing
Mon Feb 14 03:35:06 PST 2008
matt
DB_VARIABLE modified:
name=failover.isredundant
value=true
Mon Feb 14 03:35:06 PST 2008
matt
DB_VARIABLE modified:
name=failover.unitid
value=1
By default, audit logging is disabled. For information on enabling this feature, see Setting log levels.
Setting log levels
Using the Configuration utility, you can set log levels on auditing events and other types of events. The minimum log level indicates the minimum severity level at which the system logs that type of event. For more information, see To set a minimum log level for local traffic events, following.
For auditing events, you can set a log level that indicates the type of event that the system logs, such as the user-initiated loading of the Access Policy Manager system configurations, or system-initiated configuration changes. For more information, see Setting log levels for auditing events.
To set the log level for Access policy events
1.
On the navigation pane, expand System, click Logs.
The Logs screen opens.
2.
On the menu bar, click Configuration, and select Options.
The Logs screen changes to display the various logging options available.
3.
Depending on the type of log messages you want to control, scroll down to Access Policy Logging.
4.
Select the log level for the selected component, and click Update.
The log levels that you can set on certain types of events, are sequenced from highest severity to lowest severity, like this:
Emergency
Alert
Critical
Error
Warning
Notice
Informational
Debug
To set a minimum log level for local traffic events
1.
On the navigation pane, expand System, and click Logs.
The Logs screen opens.
2.
On the menu bar, click Configuration, and select Options.
The Logs screen changes to display the various logging options available.
3.
Scroll down to Local Traffic Logging.
4.
Select the log level for the selected component, and click Update.
Setting log levels for auditing events
An optional type of logging that you can enable is audit logging. Audit logging logs messages that pertain to configuration changes that users or services make to the BIG-IP system configuration. This type of audit logging is known as MCP audit logging. (For more information, see Auditing configuration changes.) Optionally, you can set up audit logging for any tmsh commands that users type on the command line.
For both MCP and tmsh audit logging, you can choose one of four log levels. In this case, the log levels do not affect the severity of the log messages; instead, they affect the initiator of the audit event.
For detailed information about auditing events, refer to the BIG-IP® TMOS®: Concepts on the Ask F5TM web site, http://support.f5.com.
The log levels for MCP and tmsh audit logging are:
Disable
This turns audit logging off. This is the default value.
Enable
This causes the system to log messages for user-initiated configuration changes only.
Verbose
This causes the system to log messages for user-initiated configuration changes and any loading of configuration data.
Debug
This causes the system to log messages for all user-initiated and system-initiated configuration changes.
To set a minimum log level for audit events
1.
On the navigation pane, expand System, and click Logs.
This Logs screen opens.
2.
On the menu bar, click Configuration and select Options.
3.
In the Audit Logging area near the bottom of the screen, select a log level from the Audit Logging list, which includes MCP and tmsh.
4.
Click Update.
Understanding reports
Access Policy Manager supplies built-in reports and enables you to create custom reports. Built-in Session Reports enable you to review information about the sessions created on the system. With Access Policy Manager, the All Sessions report is the default report and displays first. You can set a different report as the default. After displaying the default report, you can then choose to run and view other built-in reports, such as Current Sessions. You can also define and run custom reports.
Note: For information about other built-in report types and report names, see online help.
Setting the default report
The default report runs each time you open the Reports window. If you do not set the default report, the All Sessions report functions as the default.
To set the default report
1.
Open the existing default report.
2.
Run the report that you would like to use as the default.
The report opens in a new tab.
3.
In the report tab, click Set to default report.
Displaying the All Sessions report
1.
Select Access Policy > Reports > View Reports.
The Report Parameters window opens, with a one-line description of the current default report and default Restrict by Time settings.
2.
To display data for a non-default time period, select the appropriate Restrict Time settings.
3.
Click Run Reports.
The default report opens in the right pane.
4.
If the All Sessions report is not displayed, perform these steps:
a)
Scroll to the Session Reports list and select All Sessions > Run.
The Report Parameters window opens, with a one-line description of the report and default Restrict by Time settings.
b)
To display data for a non-default time period, select the appropriate Restrict by Time settings.
c)
Click Run Reports.
The All Sessions report is displayed in a new tab.
5.
To view detailed information for a session, click a Session ID.
A Session Details tab opens.
Displaying session variables for current sessions
You can view session variables for any current session.
To display session variables for a current session
1.
Select Access Policy > Reports > View Reports.
The Report Parameters window opens, with a one-line description of the default report along with default Restrict by Time settings.
2.
Click Run Reports.
The default report is displayed.
3.
In the Reports Browser pane, scroll to the Session Reports list and select Current Sessions > Run.
The Report Parameters window opens, with a one-line description of the report and default Restrict by Time settings.
4.
To display data for a non-default time period, select the appropriate Restrict by Time settings.
5.
Click Run Reports.
The Current Sessions report is displayed in a new tab.
6.
To view variables for a particular session, click the View Session Variables link in the Active column.
A Session Variables page for the specific session ID opens in a new tab.
Using scripts to view reports
In addition to viewing the reports through the navigation pane, you can also use the command line interface and script, called adminreport.pl to view additional reports, such as acllogs, logonlogs, acllogsforsession, and saforsession.
To view additional reports and logs from the command line
1.
From the command line, type adminreports.pl.
2.
Depending on the type of logs you want to view, type the following in the command line:
adminreports.pl -aclogs
adminreports.pl -logonlogs
adminreports.pl -aclogsforsession session_id
adminreports.pl -saforsession session_id
adminreports.pl -count
adminreports.pl -start <index>
adminreports.pl -end <index>
Table 13.3 lists the available command line utility commands and their descriptions.
 
Table 13.3 Command line to view additional reports
Command
Description
-aclogs
This displays the access control log messages.
-logonlogs
This returns logon log messages.
-aclogsforsession session_id
This returns access control logs for the given session id <sid>/.
-saforsession <sid>
This returns session activity information to the given session id <sid>.
-count
This returns the number of entries in access control and logon logs.
-start <index>
This returns entries starting from the given <index>. The default is the first entry <index is 1>/
-end <index>
This returns entries until the given <index>. The default is the last entry.
-help
Prints the onscreen message.
Configuring and Running Custom Reports
Custom reports enable you to define the desired data, any constraints that you want to place on the data, and the sort order to use in a report. You can save, edit, and delete custom report definitions. In addition to running custom reports, you can export the report data to files.
To configure a custom report
1.
Select Access Policy > Reports > View Reports.
The Report Parameters window opens, with a one-line description of the default report along with default Restrict by Time settings.
2.
Click Run Reports.
The default report is displayed.
3.
In the Reports Browser pane, click Custom Reports.
The Custom Reports area opens.
4.
At the bottom of the Custom Reports area, click the Create icon.
A Design Custom Report window opens with 3 tabs: Report Fields, Report Constraints, and Sort Fields.
5.
Type a unique name in the Report Name field.
6.
On the Report Fields tab, under these folders: Users, Resources, Session, and Access Policy, select fields by clicking check boxes.
7.
Optionally, create constraints on the Report Constraints tab and specify a sort order on the Sort Fields tab. For more information, see online help.
8.
Click Save.
The Design Custom Report window closes. The name of the newly created custom report is displayed under Report Names in the Custom Reports area.
To run a custom report
1.
Select Access Policy > Reports > View Reports.
The Report Parameters window opens, with a one-line description of the default report along with default Restrict by Time settings.
2.
Click Run Reports.
The default report is displayed.
3.
In the Reports Browser pane, click Custom Reports.
The Custom Reports area opens.
4.
Select the report to run and click Run Report.
A Custom Report Parameters window opens, displaying a default time range and any previously configured constraints.
5.
Change the values that are displayed or leave them as is; click Run Report.
The report displays in a new tab. The report results are not updated until you run the report again.
To work with custom reports
1.
Select Access Policy > Reports > View Reports.
The Report Parameters window opens, with a one-line description of the default report along with default Restrict by Time settings.
2.
Click Run Reports. The default report is displayed.
3.
In the Reports Browser pane, click Custom Reports.
The Custom Reports area opens.
4.
The Custom Reports area lists any custom reports and displays icons labeled as follows:
Favorites - Puts the selected report on a list of favorites.
Delete - Deletes the selected report.
Edit - Opens the Design Custom Report window for the selected report.
Run - Runs the selected report.
Export - Opens a dialog where you can select reports to export.
Import - Opens a window where you can browse files to import.
Monitoring system and user information
You can monitor overall system performance and Access Policy Manager session information. The BIG-IP® system provides a dashboard that displays system statistics graphically, showing gauges and graphs, and you can view the same statistics in a table view. You can also view user session information specific to Access Policy Manager.
You can display the BIG-IP® system main dashboard from the navigation pane. Expand Overview, and click Dashboard tab. For more information on how to monitor overall system performance for the BIG-IP® system, refer to Getting Started Guide: BIG-IP®systems.
The dashboard also includes online help for information about how to interpret statistics on each of the panels that appear on the screens. Click the question mark (?) in the upper right corner of any window to display the online help.
Viewing the Access Policy Manager dashboard
In addition to the BIG-IP® system main dashboard, you can use the Access Policy Manager dashboard to view specific Access Policy Manager users session-based statistics, as well as throughput data.
With the Access Policy Manager dashboard, you can view the following information in four distinct panels:
Active and new sessions
Network access open and new connections
Portal access cache information
Access control list transactions
To view the dashboard, on the navigation pane, expand Access Policy, and click Dashboard.
Tip: By clicking the grid icon in the upper left corner of each window, you can display the same information in a table format.
Monitoring active and new sessions
The top left panel of the Access Policy Manager dashboard displays the total and established connections for all current active and new sessions. This panel is called Access Sessions.
There are two tabs available for this panel:
Active Sessions: Displays the number of active sessions.
New Sessions: Displays the number of new sessions
You can view them in either real-time, or historical time ranges. You may want to view active sessions at various times of the day to determine the peak and select the best time to perform system maintenance, for example. If you notice that the total number of sessions peaked while the total number of established sessions remain low, this may be an indication that a possible malicious attack is occurring in your network environment.
Monitoring portal access cache information
The bottom left panel of the Access Policy Dashboard displays cache effectiveness by comparing the three available metrics. This panel is called Portal Access. There are currently no tabs available for this panel, but the metrics include:
Client Requests: Displays the total cache requests from the client.
Request Served from RamCache: Displays the total number of cache hits.
Requests Missed from RamCache: Displays the total number of cache misses.
Hits and misses are derived by subtracting the server responses from the client responses. A server response indicates that the requested information was not in cache.
Monitoring network access throughput and connections
The right top panel of the Access Policy dashboard displays throughput data for the amount of traffic through the network access tunnels, as well as displays open and new connections. This panel is called Network Access.
You can view throughput numbers to and from the client, as well as the overall throughput for network access traffic.
Use this panel to determine how much traffic is going through the tunnels, and how many people are generating that traffic. For example, if there are two tunnels, and those particular users are generating gigabytes of traffic, you may want to further investigate the activities on those tunnels.
This panel is also useful as a good indicator for peaked traffic to determine the best time to perform system maintenance
There are four tabs available for this panel:
Throughput: Displays the amount of throughput for data transfers through the network access tunnels.
Open Connections: Displays the number of open connections through the network access tunnels.
New Connections: Displays the number of new connections through the network access tunnels.
Compression: Displays the compression level through the network access tunnel. The Compression tab provides a gauge as well as a chart.
Monitoring access control list information
The bottom right panel of the Access Policy Dashboard displays ACL activities.
There is one tab available for this panel:
ACL Actions: Displays the action that the access control list takes when an access control entry is encountered.
Table of Contents   |   << Previous Chapter   |   Next Chapter >>

Was this resource helpful in solving your issue?




NOTE: Please do not provide personal information.

Additional Comments (optional)

About F5

Education

F5 Sites

Support Tasks

Connect with us

© Copyright 2018 by F5 Networks, Inc. | Policies | Privacy | Trademarks