CirrocumulusBIG-IP syslog include
BIG-IP remote syslog with short names, iso dates, and milli/microseconds
It looks like syslog-ng is broken on a number of BIG-IP releases. Using use_fqdn(no) still gets fqdns in the logs. This looks to have been broken here:
https://cdn.f5.com/product/bugtracker/ID998649.html
Our work around is to add a rewrite filter that removes the domain name. Login, run tmsh, command "edit sys syslog" and enter the below. You probably want to clear any remote syslog setup in the UI first.
sys syslog {
include "
# short hostnames
options {
frac_digits(6);
keep_hostname(no);
use_fqdn(no);
};
# F5 use-fqdn is broken in
# https://cdn.f5.com/product/bugtracker/ID998649.html
# so replace '\\.*' with ''
rewrite r_domain {
subst(\"\\\\..*\", \"\", value(\"HOST\"));
};
# Remote syslog in RFC5424 - Tim Riker <Tim@Rikers.org>
destination d_remote_loghost {
# put your syslog IP here in place of the 0.0.0.0
syslog(0.0.0.0 port(514));
};
log {
source(s_syslog_pipe);
rewrite(r_domain);
destination(d_remote_loghost);
};
"
}
Note: this output does NOT appear to be RFC5424 compliant. For example system output includes a priority field following the hostname, where rfc5424 does not include that in it's spec.
We have validated this on Version 17.x and are working on other versions as well. Here is the link to the article.
Using use_fqdn(no) in syslog configuration still includes the hostname/FQDN in the logs. (f5.com)
