Access Policy Manager^® (APM^®) provides a default-log-setting. When you create an access profile, the default-log-setting is automatically assigned to it. The default-log-setting can be retained, removed, or replaced for the access profile. The default-log-setting is applied to user sessions only when it is assigned to an access profile.

Regardless of whether it is assigned to an access profile, the default-log-setting applies to APM processes that run outside of a user session. Specifically, on a BIG-IP^® system with an SWG subscription, the default-log-setting applies to URL database updates.

1. On the Main tab, click Local Traffic > Pools .
   The Pool List screen opens.
2. Click Create.
   The New Pool screen opens.
3. In the Name field, type a unique name for the pool.
4. Using the New Members setting, add the IP address for each remote logging server that you want to include in the pool:
   1. Type an IP address in the Address field, or select a node address from the Node List.
   2. Type a service number in the Service Port field, or select a service name from the list.
      Note: Typical remote logging servers require port 514.
   3. Click Add.
5. Click Finished.

1. On the Main tab, click System > Logs > Configuration > Log Destinations .
   The Log Destinations screen opens.
2. Click Create.
3. In the Name field, type a unique, identifiable name for this destination.
4. From the Type list, select Remote High-Speed Log.
   Important: If you use log servers such as Remote Syslog, Splunk, or ArcSight, which require data be sent to the servers in a specific format, you must create an additional log destination of the required type, and associate it with a log destination of the Remote High-Speed Log type. With this configuration, the BIG-IP system can send data to the servers in the required format.
   The BIG-IP system is configured to send an unformatted string of text to the log servers.
5. From the Pool Name list, select the pool of remote log servers to which you want the BIG-IP system to send log messages.
6. From the Protocol list, select the protocol used by the high-speed logging pool members.
7. Click Finished.

1. On the Main tab, click System > Logs > Configuration > Log Destinations .
   The Log Destinations screen opens.
2. Click Create.
3. In the Name field, type a unique, identifiable name for this destination.
4. From the Type list, select a formatted logging destination, such as Remote Syslog, Splunk, or ArcSight.
   The Splunk format is a predefined format of key value pairs.
   The BIG-IP system is configured to send a formatted string of text to the log servers.
5. If you selected Remote Syslog, then from the Syslog Format list select a format for the logs, and then from the High-Speed Log Destination list, select the destination that points to a pool of remote Syslog servers to which you want the BIG-IP system to send log messages.
   Important: For logs coming from Access Policy Manager^® (APM^®), only the BSD Syslog format is supported.
6. If you selected Splunk, then from the Forward To list, select the destination that points to a pool of high-speed log servers to which you want the BIG-IP system to send log messages.
   The Splunk format is a predefined format of key value pairs.
7. Click Finished.

1. On the Main tab, click System > Logs > Configuration > Log Publishers .
   The Log Publishers screen opens.
2. Click Create.
3. In the Name field, type a unique, identifiable name for this publisher.
4. For the Destinations setting, select a destination from the Available list, and click << to move the destination to the Selected list.
   Note: If you are using a formatted destination, select the destination that matches your log servers, such as Remote Syslog, Splunk, or ArcSight.
5. Click Finished.

1. On the Main tab, click Access > Overview > Event Logs > Settings .
   A log settings table screen opens.
2. Select a log setting and click Edit or click Create for a new APM^® log setting.
   A popup screen opens with General Information selected in the left pane.
3. For a new log setting, in the Name field, type a name.
4. To specify logging, select one or both of these check box options:
   • Enable access system logs - This setting is generally applicable. It applies to access policies, per-request policies, Secure Web Gateway processes, and so on. When you select this check box, Access System Logs becomes available in the left pane.
   • Enable URL request logs - This setting is applicable for logging URL requests when you have set up a BIG-IP^® system configuration to categorize and filter URLs. When you select this check box, URL Request Logs becomes available in the left pane.
   Important: When you clear either of these check boxes and save your change, you are not only disabling that type of logging, but any changes you made to the settings are also removed.
5. To configure settings for access system logging, select Access System Logs from the left pane.
   Access System Logs settings display in the right panel.
6. For access system logging, from the Log Publisher list select the log publisher of your choice.
   A log publisher specifies one or more logging destinations.
   Important: The BIG-IP^® system is not a logging server and has limited capacity for storing, archiving, and analyzing logs. For this reason a dedicated logging server is recommended.
7. For access system logging, retain the default minimum log level, Notice, for each option.
   You can change the minimum log level, but Notice is recommended.

   Option	Description
   Access Policy	Events that occur while an access policy runs.
   Per-Request Policy	Events that occur while a per-request policy runs.
   ACL	Events that occur while applying APM access control lists.
   SSO	Events that occur during single-sign on.
   Secure Web Gateway	Events that occur during URL categorization on a BIG-IP® system with an SWG subscription.
   ECA	Events that occur during NTLM authentication for Microsoft Exchange clients.
   OAuth	Events that occur while APM, as an OAuth authorization server, processes requests.
   PingAccess Profile	Events related to PingAccess authentication. Important: For PingAccess authentication, only the log levels defined in default-log-settings apply.
   VDI	Events related to connections to virtual desktop resources.
   Endpoint Management System	Events related to connections to an endpoint management system.

8. To configure settings for URL request logging, select URl Request Logs from the left pane.
   URL Request Settings settings display in the right panel.
9. For URL request logging, from the Log Publisher list, select the log publisher of your choice.
   A log publisher specifies one or more logging destinations.
   Important: The BIG-IP^® system is not a logging server and has limited capacity for storing, archiving, and analyzing logs. For this reason a dedicated logging server is recommended.
10. To log URL requests, you must select at least one check box option:

    • Log Allowed Events - When selected, user requests for allowed URLs are logged.

    • Log Blocked Events - When selected, user requests for blocked URLs are logged.
    • Log Confirmed Events - When selected, user requests for confirmed URLs are logged.
    Whether a URL is allowed, blocked, or confirmed depends on both the URL category into which it falls, and the URL filter that is applied to the request in the per-request policy.
11. Optional: To assign this log setting to multiple access profiles now, perform these substeps:
    Note: Up to three log settings for access system logs can be assigned to an access profile. If you assign multiple log settings to an access profile, and this results in duplicate log destinations, logs are also duplicated.
    1. Select Access Profiles from the left pane.
    2. Move access profiles between the Available and the Selected lists.
    Note: You can delete (and add) log settings for an access profile on the Logs page for the access profile.

    Note: You can configure the log destinations for a log publisher from the Logs page in the System area of the product.
12. Click OK.
    The popup screen closes. The table displays.

1. To clear log settings from access profiles, on the Main tab, click Access > Profiles / Policies .
2. Click the name of the access profile.
   Access profile properties display.
3. On the menu bar, click Logs.
4. Move log settings from the Selected list to the Available list.
5. Click Update.

Event log levels are incremental, ranging from most severe (Emergency) to least severe (Debug). Setting an event log level to Warning for example, causes logging to occur for warning events, in addition to events for more severe log levels. The possible log levels, in order from highest to lowest severity are:

• Emergency
• Alert
• Critical
• Error
• Warning
• Notice (the default log level)
• Informational
• Debug

1. On the Main tab, click System > Logs > Configuration > Log Publishers .
   The Log Publishers screen opens.
2. Select the log publisher you want to update and click Edit.
3. For the Destinations setting, select local-db from the Available list, and move the destination to the Selected list.
4. Click Finished.

1. On the Main tab, click Access > Overview > Access Reports .
   The Reports Browser displays in the right pane. The Report Parameters popup screen opens and displays a description of the current default report and default time settings.
2. Optional: Select the appropriate Restrict by Time settings.
3. Click Run Report.
   The popup screen closes. The report displays in the Reports Browser.

1. On the Main tab, click Access > Overview > Event Logs > URL Request Logs .
   Any logs for the last hour are displayed.

   Note: APM^® writes logs for blocked requests, confirmed requests, allowed requests, or all three, depending on selections in the access profile log setting.
2. To view logs for another time period, select it from the list.
3. To search the logs, type into the field and click Search or click Custom Search to open a screen where you can specify multiple search criteria.
4. To export the logs for the time period and filters, click Export to CSV.

1. On the Main tab, click System > Logs > Configuration > Log Publishers .
   The Log Publishers screen opens.
2. Select the log publisher you want to update and click Edit.
3. For the Destinations setting, select local-syslog from the Available list, and move the destination to the Selected list.
4. Click Finished.

1. On the Main tab, click System > Logs > Configuration > Log Publishers .
   The Log Publishers screen opens.
2. Select the log publisher you want to update and click Edit.
3. For the Destinations setting, if the Selected list contains local-syslog, move it to the Available list.
4. Click Finished.

The BIG-IP^® system publishes logs for portal access traffic and for connections to virtual desktops (VDI) to the /var/log/rewrite* files. APM^® cannot publish these logs to remote destinations.

APM can publish URL request logs to remote or local destinations. Logs published to the local-db destination are stored in the local database and are available for display from the Configuration utility. Logs published to the local-syslog destination are stored in the /var/log/urlfilter.log file.

APM can publish access system logs to remote or local destinations. Logs published to the local-db destination are stored in the local database. Logs in the local database are available for display in APM reports. Logs published to the local-syslog destination are stored in the /var/log/apm file.

The BIG-IP^® system log messages contain codes that provide information about the system. You can run the Linux command cat log |bigcodes |less at the command prompt to expand the codes in log messages to provide more information. For example:

   Jun 14 14:28:03 sccp bcm56xxd [ 226 ] : 012c0012 : (Product=BIGIP Subset=BCM565XXD) : 6: 4.1 rx [ OK 171009 Bad 0 ] tx [ OK 171014 Bad 0 ]