Merge pull request #385 from splunk/fix/f5

Correct log path
CSVD · Mar 27, 2020 · 7568570 · 7568570
2 parents d3c7c77 + 644a29d
commit 7568570
Show file tree

Hide file tree

Showing 2 changed files with 7 additions and 1 deletion.
diff --git a/package/etc/conf.d/filters/f5/bigip.conf.tmpl b/package/etc/conf.d/filters/f5/bigip.conf.tmpl
@@ -1,5 +1,10 @@
 filter f_f5_bigip {
-    match("^f5_bigip", value("fields.sc4s_vendor_product"));
+    match("^f5_bigip", value("fields.sc4s_vendor_product"))
+    or
+    program("tmsh")
+    or program("mcpd")
+    or program("tmm\d?")
+    or program('^,f5_irule');
 };
 filter f_f5_bigip_message {
     message(

diff --git a/package/etc/conf.d/log_paths/lp-f5_bigip.conf.tmpl b/package/etc/conf.d/log_paths/lp-f5_bigip.conf.tmpl
@@ -15,6 +15,7 @@ log {
         channel {
         # Listen on the default port (typically 514) for F5_BIGIP traffic
             source (s_DEFAULT);
+            filter(f_f5_bigip);
             flags(final);
         };
     };