lb log

The lb log command creates the log profiles that determine where and in which format the traffic logs of a vService will be sent. When the profile is bound to a vService, the logs of that service start flowing to the stated servers. Its panel equivalent is the Logging section.

Command Summary

TR7 WEB-CLI · lb log

# Tab after the command

admin@TR7LBWAF01> lb log

add delete list show update

 

admin@TR7LBWAF01> lb log list # list all of them

admin@TR7LBWAF01> lb log show <id> # show one

admin@TR7LBWAF01> lb log add name <name> … # new profile

admin@TR7LBWAF01> lb log update id <id> … # change

admin@TR7LBWAF01> lb log delete <id> # delete

admin@TR7LBWAF01>  

Writing Order

Step 1 Write the name

This is the only required field: lb log add traffic-log

Step 2 Add the log servers

--logAddresses.0.ip.ip 10.0.50.10 --logAddresses.0.ip.port 514

Step 3 Select the format

--lineFormat tr7json --logStandard rfc5424

Step 4 Bind it to a vService

lb service update id <vService> --log <profile>

Required Fields

Order	Field	Status	Value
1	name	Required	The name of the profile; it must be unique in the collection

The Log Servers

Every server is written with its own index. There can be at least one and at most ten servers in the list.

Field	What it does	What is written after it
--logAddresses.N.ip.ip	Determines the address of the server to which the logs will be sent	An IP address
--logAddresses.N.ip.port	Determines the port of the server	A port (default 514)
--logAddresses.N.sampling	Thins out the sent logs; when a value is given, the logs are sampled at this rate	An integer between 1 and 524288. When it is left empty, all the logs are sent

The Format Fields

Field	What it does	What is written after it
--logStandard	Selects with which sending standard the log will be packaged	local (default) · rfc3164 · rfc5424 · priority · raw
--lineFormat	Selects the format of the log line	apache (the standard log format) · apache-combined · apache-vhost · cef · tr7json · tr7waf · manualJSON · manualCEF · manual
--manualLineFormat	Writes the line format by hand from start to end	A smart content expression; it opens and becomes required only when --lineFormat manual is selected
--manualLogEntries.N.key	Determines the name of the field to be added to the log	A field name; unique within the profile. It opens only when --lineFormat manualJSON or manualCEF is selected
--manualLogEntries.N.value	Determines the value of that field	A smart variable; Tab lists the usable ones

The three manual writing formats are separate from each other

In the manual format the whole line is written with --manualLineFormat. In the manualJSON and manualCEF formats the skeleton of the line is ready; the fields to be put inside it are added with the --manualLogEntries.N pairs.

Examples

TR7 WEB-CLI · A) A standard profile with two servers

admin@TR7LBWAF01> lb log add name traffic-log \

--logAddresses.0.ip.ip 10.0.50.10 --logAddresses.0.ip.port 514 \

--logAddresses.1.ip.ip 10.0.50.11 --logAddresses.1.ip.port 514 \

--logStandard rfc5424 --lineFormat tr7json

admin@TR7LBWAF01>  

TR7 WEB-CLI · B) A profile with sampling and manual fields

# one out of every 100 logs is sent

admin@TR7LBWAF01> lb log add name sampled \

--logAddresses.0.ip.ip 10.0.50.10 --logAddresses.0.sampling 100

 

# adding custom fields to the JSON skeleton

admin@TR7LBWAF01> lb log add name custom-json --lineFormat manualJSON \

--logAddresses.0.ip.ip 10.0.50.10 \

--manualLogEntries.0.key organization --manualLogEntries.0.value <variable> \

--manualLogEntries.1.key environment --manualLogEntries.1.value <variable>

admin@TR7LBWAF01>  

Updating and Deleting

TR7 WEB-CLI · update and delete

# changing the port of an existing server · adding a new server

admin@TR7LBWAF01> lb log update id <id> --logAddresses.0.ip.port 1514

admin@TR7LBWAF01> lb log update id <id> --logAddresses.2.ip.ip 10.0.50.12

 

# removing a single server · emptying the list

admin@TR7LBWAF01> lb log update id <id> --logAddresses.1.delete

admin@TR7LBWAF01> lb log update id <id> --manualLogEntries.delete

 

admin@TR7LBWAF01> lb log delete <id>

admin@TR7LBWAF01>  

Things to Know

• A profile does not work on its own. The log sending starts when the profile is bound to a vService with the --log field.
• The number of servers is limited. There can be at least one and at most ten log servers in the list.
• Sampling means log loss. When --logAddresses.N.sampling is given, the logs are sent thinned out; in the places where a complete record is needed it is left empty.
• The manually written fields carry smart variables. The values written in the --manualLogEntries.N.value field can be variables resolved from the request.
• The name is unique. A second profile with the same name cannot be created.