F5

Overview

F5 BIG-IP is a family of application delivery controllers (ADC) and security products. BIG-IP devices provide load balancing, SSL offloading, web application firewall (WAF), and Global Traffic Manager (GTM) capabilities. Devices generate syslog messages for traffic events, system health, High Availability (HA) status, and hardware alerts.

App Function

• Parse F5 syslog messages in the format process[pid]: code:severity: message
• Extract metadata tags for filtering and analysis
• Categorize events by process type (traffic, GTM, HA, audit, system)
• Provide dashboards for monitoring traffic errors, HA status, and hardware
• Alert on critical hardware failures and HA conditions

Vendor Documentation

• F5 BIG-IP Documentation
• BIG-IP System Logging
• Log Message Reference

Device Configuration

Configure F5 BIG-IP to send syslog messages to LogZilla:

1. Log into the BIG-IP Configuration utility
2. Navigate to System > Logs > Configuration > Remote Logging
3. Click Create to add a new remote logging destination
4. Configure the following settings:
   • Name: LogZilla
   • IP Address: LogZilla server IP address
   • Remote Port: 514 (or custom syslog port)
   • Protocol: UDP or TCP
5. Click Finished to save

Verification

Generate test traffic or trigger a configuration change, then verify events appear in LogZilla with the Vendor tag set to F5.

Incoming Log Format

F5 BIG-IP syslog messages follow this format:

text
Wrap: OnCopyFullscreen
process[pid]: code:severity: message

• process - F5 process name (tmm, gtmd, mcpd, sod, httpd, syslog-ng, alertd)
• pid - Process ID
• code - 8-character hex message code (e.g., 01220001)
• severity - Numeric severity level (0-7)
• message - Event description

Parsed Metadata Fields

Log Examples

TCL Error (iRule)

text
Wrap: OnCopyFullscreen
tmm[1234]: 01220001:3: TCL error: /Common/selectpool_us-east <HTTP_REQUEST>
- no such pool: /Common/web_pool_prod (line 42) invoked from within
"active_members $localpool"

SSL Handshake Failed

text
Wrap: OnCopyFullscreen
tmm1[5678]: 01260013:4: SSL handshake failed for TCP 192.168.1.100:54321
-> 10.1.1.50:443

GTM Monitor Error

text
Wrap: OnCopyFullscreen
gtmd[3456]: 011ae044:3: Could not find monitor object 10.1.1.100:443 on
server:vs /Common/dc1-prod-ltm-pair:/Common/https_vs_prod

HA Heartbeat

text
Wrap: OnCopyFullscreen
sod[5555]: 01140029:5: HA daemon_heartbeat status UP for bigip1.local

Audit Login

text
Wrap: OnCopyFullscreen
mcpd[2222]: 01070417:6: AUDIT - user admin logged in from 192.168.1.50

Hardware Alert

text
Wrap: OnCopyFullscreen
alertd[7777]: 010d0001:2: Cpu temperature is too high.

MITRE ATT&CK Mapping

Dashboards

Triggers