F5 Logo MyF5
Search
  1. MyF5 Home
  2. BIG-IQ: Network Security
  3. Managing External Logging Devices
Manual Chapter : Managing External Logging Devices

Applies To:

Show Versions Show Versions

BIG-IQ Centralized Management

  • 7.1.0
Manual Chapter

Managing External Logging Devices

About external logging devices

You can use external logging devices to collect log files from BIG-IP devices for viewing from a web interface launched from the F5 BIG-IQ Centralized Management system. Currently, only the SevOne Performance Log Appliance (SevOne PLA) is supported. As part of supporting external logging devices, the BIG-IQ Centralized Management system pushes (transfers) BIG-IP device management IP- and self IP address information to the external logging device.
You need to add an external logging device to the management system before you can use it. You add, modify, or remove external logging devices from the management system by selecting
System Management
BIG-IQ LOGGING
External Logging Devices
.
Once you have added the external logging device, you need to set up authentication with the device so that you can then launch the user interface to manage the device. You perform these tasks by selecting
Network Security
Monitoring
External Logging Devices
.

Add external logging devices

You can add an external logging device to the F5 BIG-IQ Centralized Management system to collect log files from BIG-IP devices. Currently only the SevOne Performance Log Appliance (SevOne PLA) is supported.
  1. At the top left of the screen, select
    System Management
    from the BIG-IQ menu.
  2. In the list on the left, click
    BIG-IQ LOGGING
     and then click
    External Logging Devices
    .
  3. Click
    Add
    .
    The Add External Logging Device screen opens.
  4. Type a name and an optional description for the external logging device.
  5. Type the connection information for the SevOne PLA device.
    1. Specify the IP address of the external logging device in the
      IP Address
       field. If the external logging device is also a query server, select the
      Use as query server
       check box to the right of the
      IP Address
       field. Query servers are members of the SevOne PLA logging device cluster that process user queries.
    2. In the
      User Name
       field, specify the user name of the account used to securely access the SevOne PLA device.
    3. In the
      Password
       field, specify the password for the selected account .
    4. Once the connection information is complete, click
      Test
       to verify that the connection information can be used to access the SevOne PLA device. If the test is successful, a green check mark and the text
      Connection Established
       are shown in the Test Connection row.
  6. Type the query server information for the device.
    1. Add the first query server IP address in the
      IP Address
       field.
    2. Add additional query servers by clicking the
      +
       to the right of the description and then supplying an IP address for each in the created
      IP Address
      fields.
    3. Remove query servers by clicking the
      X
       to the right of the query server to remove.
  7. Optionally, select the
    Enabled
     check box in the
    Status
     setting to allow scheduling for data pushes from the BIG-IQ Centralized Management system to the SevOne PLA device, and to enable editing for the other fields in this area.
    • To have the data pushed every day,for the
      Push Frequency
       setting, select
      Daily
      .
    • To push the data once a month, in the
      Push Frequency
       setting, select
      Monthly
      , and then select the day of the month.
    • To push the data each week, in the
      Push Frequency
       setting, select
      Weekly
       and then select one or more days of the week.
  8. Specify when to begin, and optionally end, the scheduled data push.
    Select the date and time using the calendar tool, or type the date, hour, and minute to use. By default,
    No End Date
     is selected and must be cleared to specify an end time.
  9. Click
    Push Now
     in the
    Last Push Date
     setting to manually push the data to the external logging device.
  10. Click
    Add
     to save your changes.
    After you successfully add your changes, the screen shows the
    Last Push Date
     setting. You can use the
    Push Now
     button in that row to manually push data to the external logging device.
The external logging device is added to the BIG-IQ Centralized Management system.
You can now configure authentication with the external logging device so that you can manage logs using the SevOne PLA user interface.

Modify external logging devices

You can modify settings for external logging devices used with the F5 BIG-IQ Centralized Management system when the computing environment changes.
  1. At the top left of the screen, select
    System Management
    from the BIG-IQ menu.
  2. In the list on the left, expand
    BIG-IQ LOGGING
     and then click
    External Logging Devices
    .
  3. Click the name of the external logging device to modify.
    The External Logging Device (
    device-name
    ) screen opens.
  4. Modify the description for the external logging device, as needed.
  5. Modify the connection information for the SevOne PLA device, as needed.
    1. Specify the IP address of the external logging device in the
      IP Address
       field. If the external logging device is also a query server, select the
      Use as query server
       check box to the right of the
      IP Address
       field. Query servers are members of the SevOne PLA logging device cluster that process user queries.
    2. Specify the user name of the account used to securely access the SevOne PLA device in the
      User Name
       field.
    3. Specify the password for the selected account in the
      Password
       field.
    4. Click
      Test
       once the connection information is complete to verify that the connection information can be used to access the SevOne PLA device. If the test is successful, a green check mark and the text
      Connection Established
       are shown in the
      Test Connection
       setting.
  6. Modify the query server information for the device, as needed.
    1. Add the first query server IP address in the
      IP Address
       field.
    2. Add additional query servers by clicking the
      +
       to the right of the description and then supplying an IP address for each in the created
      IP Address
      fields.
    3. Remove query servers by clicking the
      X
       to the right of the query server to be removed.
  7. Optionally, select the
    Enabled
     check box in the
    Status
     setting to allow data pushes from the BIG-IQ Centralized Management system to the SevOne PLA device to be scheduled and to enable the other fields in this area for editing.
    • Select
      Daily
       in the
      Push Frequency
       setting to have the data pushed every day.
    • Select
      Monthly
       in the
      Push Frequency
       setting and then select the day of the month to push the data once a month.
    • Select
      Weekly
       in the
      Push Frequency
       setting and then select one or more days of the week to push the data each week.
  8. Specify when to begin, and optionally end, the scheduled data push.
    Select the date and time using the calendar tool, or type the date, hour, and minute to use. By default,
    No End Date
     is selected and must be cleared to specify an end time.
  9. Click
    Save
     to save your changes.
    You can use the
    Push Now
     button in the
    Last Push Date
     setting to manually push the data to the external logging device.
The external logging device is updated in the BIG-IQ Centralized Management system.
Depending on the changes you made, you may need to configure authentication with the external logging device so that you can manage logs using the SevOne PLA user interface.

Remove external logging devices

You can remove external logging devices from the F5 BIG-IQ Centralized Management system when those devices are no longer needed.
  1. At the top left of the screen, select
    System Management
    from the BIG-IQ menu.
  2. In the list on the left, click
    BIG-IQ LOGGING
     and then click
    External Logging Devices
    .
  3. Click the check box to the left of the name of the external logging device to remove.
  4. Click
    Remove
    .
    A dialog box opens, asking you to confirm that you want to remove the device.
  5. Click
    Delete
     in the dialog box.
The device is removed and is no longer seen in the list of devices.

Request authentication token for external logging devices

You must add the external logging device to theF5 BIG-IQ Centralized Management system before you can request an authentication token for it.
You request an authentication token for the external logging device so you can access the web interface to the external logging device and the BIG-IP device logs stored there.
  1. At the top left of the screen, select
    Network Security
     from the BIG-IQ menu.
  2. From the menu at the top click
    Monitoring
    , and then on the left click
    External Logging Devices
    .
  3. Request an authentication token by clicking the link displayed in the Auth token column for the appropriate external logging device.
    • If you do not have an authentication token to access the SevOne PLA, you request it by clicking
      Request Auth Token
      .
    • If you want to replace an existing authentication token, you request a new one by clicking
      Manage Auth Token
      .
    The Manage SevOne PLA Authentication Token dialog box opens.
  4. Type the user name and password for an account with privileges to use the web interface to the SevOne PLA device.
  5. Click
    Request Token
    .
    A new authentication token is sent from the SevOne PLA device, and the new token string is displayed.
  6. Click
    Save
     to save the token and close the dialog box.
The authentication token is created and is used when you launch the SevOne PLA user interface.

Delete authentication token for external logging devices

You must have an authentication token before you can delete it.
You delete authentication tokens with an external logging device when then are no longer needed or should be replaced.
  1. At the top left of the screen, select
    Network Security
     from the BIG-IQ menu.
  2. From the menu at the top click
    Monitoring
    , and then on the left click
    External Logging Devices
    .
  3. Click the check box to the left of the external logging device that should have the authentication token removed.
  4. Click
    Delete Auth Token
    .
You no longer have an authentication token for the external logging device. You will need to request a new authentication token to communicate with the external logging device user interface.

Access external logging devices

You must add the external logging device to the F5 BIG-IQ Centralized Management system before you can access it. You must also have authenticated your account with the external logging device.
You access and launch the web interface to the external logging device to access the BIG-IP device logs stored there.
  1. At the top left of the screen, select
    Network Security
     from the BIG-IQ menu.
  2. At the top click
    Monitoring
    , and then on the left click
    External Logging Devices
    .
  3. In the External Device column, click
    Launch
     for the appropriate external logging device.
    The SevOne PLA user interface opens.
You can now use SevOne PLA to review the BIG-IP device logs.
Contact Support Contact Support

Have a Question?

Support and Sales >

About F5

Education

F5 Sites

Support Tasks




©2023 F5, Inc. All rights reserved.


Trademarks Policies Privacy California Privacy Do Not Sell My Personal Information