settings log-transport

The settings log-transport command manages the sending out of the logs the device produces. Every record defines a destination: to which server, with which protocol, in which format and from which sources the logs will be sent.

Command Summary

TR7 WEB-CLI · settings log-transport

# Tab after the command

admin@TR7LBWAF01> settings log-transport

add delete list show update

 

admin@TR7LBWAF01> settings log-transport list

admin@TR7LBWAF01> settings log-transport add name <name> transportType syslog …

admin@TR7LBWAF01> settings log-transport update id <id> …

admin@TR7LBWAF01> settings log-transport delete <id>

admin@TR7LBWAF01>  

Required Fields

In the add command the CLI asks for the required fields one by one in the order below and does not show the next one until one is written. The fields are written with the field name and the value together.

Order	Field	Status	Value
1	name	Required	A name specific to the record; the same name cannot be used in two records
2	transportType	Required	syslog — Syslog. The only value defined in this version; the type-dependent fields are listed after this selection
3	syslogHost	Conditionally required	Only while transportType syslog; the server name or IP address the logs will be sent to

When a -- field is added to the line, the conditionally required fields also switch to the -- prefixed writing; Tab shows the correct writing at every step.

In the update command the record to be edited is selected with id <id>; in the show and delete commands the identifier is written without the field name (settings log-transport delete <id>). The identifiers are taken from the list output.

The Syslog Destination

The fields below are listed while transportType syslog is selected.

Field	What it does	What is written after it
--syslogHost	Determines the syslog server the logs will be sent to	The server name or IP address. It is required (see order 3)
--syslogPort	Determines the port of the server	A port number (the default is 514)
--syslogProtocol	Selects which transport protocol the sending will be done with	udp (the default) · tcp
--syslogFormat	Selects which standard the syslog header will be written according to	rfc3164 (the default) · rfc5424
--syslogMessageFormat	Selects which format the message body will be written in	json — JSON (the default) · cef — CEF (Common Event Format) · plainText — Plain Text
--syslogAppName	Determines the application name that will appear in the message	An application name (the default is TR7_syslog_client)

The Content Fields

Field	What it does	What is written after it
--namespace	Selects which routing table the sending will go out from	A routing table (the default is 1)
--language	Selects the language of the log texts sent	en (the default) · tr
--sources.N	Selects which log sources will be sent	userLogs — User Logs · hcLogs — Health Check Logs · poolStatusLogs — vService Status Logs · notificationLogs — Notification Logs · gtmLogs — GTM Logs. By default all five are selected; at least one source must remain
--hcLogsVerbose	Determines whether all of the health checks or only the status changes will be sent	true sends all of them · false sends only the status changes (the default). It is opened while there is hcLogs among the sources
--userLogChanges	Determines whether the field-based change list (what was added, deleted, changed) will be added to the user operation logs	true (the default) · false. It is opened while there is userLogs among the sources

Examples

TR7 WEB-CLI · the log forwarding

# a JSON sending with an RFC 5424 header over TCP

admin@TR7LBWAF01> settings log-transport add name siem transportType syslog \

--syslogHost 10.0.1.60 --syslogPort 514 --syslogProtocol tcp \

--syslogFormat rfc5424 --syslogMessageFormat json --language en

 

# only the user operations, with the change detail

admin@TR7LBWAF01> settings log-transport add name audit transportType syslog \

--syslogHost 10.0.1.61 --sources.0 userLogs --userLogChanges true

 

# changing and deleting an existing record

admin@TR7LBWAF01> settings log-transport list

admin@TR7LBWAF01> settings log-transport update id <id> --syslogProtocol tcp

admin@TR7LBWAF01> settings log-transport delete <id>

admin@TR7LBWAF01>  

Things to Know

• The name is asked first, then the type. The CLI asks for the name, transportType and syslogHost fields in order; the type-dependent fields are not listed until transportType is written.
• The required fields do not take --. The name and transportType field names are written side by side with their values; the optional fields are in the --field value format. When a -- field is added to the line, syslogHost is also written as --syslogHost. The detail is on the API Commands page.
• The source list cannot be emptied. --sources.N must carry at least one value; by default all five sources are selected.
• Two fields depend on the source selection. --hcLogsVerbose is listed only while there is hcLogs among the sources and --userLogChanges only while there is userLogs.
• Sending all of the health checks increases the volume. While --hcLogsVerbose false, only the status changes are sent; when the field is opened, every check produces a separate record.
• More than one destination can be defined. Every record carries its own server, format and source set; the same log can be sent to more than one destination in different formats.
• The access depends on the routing table. The syslog server must be reachable from the table selected with --namespace; the tables are managed with the network namespace command.
• The files are sent with a separate command. The transfer of the report and backup files is in the settings file-transport command.