[F5] L4스위치 Log 확인 방법

F5 L4 스위치의 Log 검색 방법에 대해 정리합니다.

로그 확인은 GUI 와 CLI 에서 확인할 수 있으며, 최근 로그는 GUI 에서 확인가능하지만

일정 기간이 지나간 로그는 CLI 를 통해서만 확인할 수 있습니다.

 

 

GUI

GUI 상에서 Log 확인 방법은 [System] - [Logs] - [Local Traffic]  메뉴에서 확인가능합니다.

 

 

하지만 GUI 상에서 확인 가능한 Log 는 기본적으로 하루 동안의 Log 만 확인가능하고,

그 이상의 기간이 지난 Log 들은 CLI 를 통해서만 확인할 수 있습니다.

 

CLI

 

ssh 를 이용해 L4 스위치에 접속한 다음 tmsh 입력하여 shell 모드로 진입합니다.

 

(tmos)# show sys log all

 

jinhyun@(SVR_L4_1)(cfg-sync In Sync)(Active)(/Common)(tmos)# show sys log all

Sys::Log
 daemon       : Unix Daemon Logs
 gtm          : Global Traffic Manager Logs
 kernel       : Linux Kernel Messages
 ltm          : Local Traffic Manager Logs
 mail         : Mail Daemon Logs
 messages     : Application Messages
 security     : Security Related Messages
 tmm          : Traffic Manager Microkernel Logs
 user         : Various user process logs
 webui        : Logs for the Web User Interface
 audit        : Audits of configuration changes
jinhyun@(SVR_L4_1)(cfg-sync In Sync)(Active)(/Common)(tmos)# 

확인할 수 있는 Log 의 종류는 위와 같습니다.

daemon, gtm, kernel, ltm 등등 여러가지가 있습니다만, 

LoadBalancing 관련 Log 는 Local Traffic Manager Log 인 "LTM" 로그를 확인하시면 됩니다.

 

 

 

(tmos)# show sys log ltm

jinhyun1@(SVR_L4_1)(cfg-sync In Sync)(Active)(/Common)(tmos)# show sys log ltm

Sys::Log
ltm 11-23 18:14:05 info localhost audit_forwarder: audit_forwarder started. 
ltm 11-23 18:15:33 notice localhost mcpd[5555]: Pool /Common/Pool_Lync_edge_50003 member /Common/APL01:50003 monitor status down. [ /Common/tcp_3_10_50003: down; last error: /Common/tcp_3_10_50003: Unable to connect. @2020/11/24 03:15:33.  ]  [ was up for 44hrs:24mins:4sec ] 
ltm 11-23 18:15:37 notice localhost mcpd[5555]: Pool /Common/Pool_Lync_edge_50003 member /Common/APL01:50003 monitor status up. [ /Common/tcp_3_10_50003: up ]  [ was down for 0hr:0min:4sec ] 
ltm 11-23 19:03:07 notice localhost mcpd[5555]: Pool /Common/Pool_Lync_5076 member /Common/APL01:5076 monitor status down. [ /Common/tcp_3_10_5076: down; last error: /Common/tcp_3_10_5076: No successful responses received before deadline. @2020/11/24 04:03:07.  ]  [ was up for 37hrs:8mins:2sec ] 
ltm 11-23 19:03:09 notice localhost mcpd[5555]: Pool /Common/Pool_Lync_5076 member /Common/APL01:5076 monitor status up. [ /Common/tcp_3_10_5076: up ]  [ was down for 0hr:0min:2sec ] 
ltm 11-23 19:06:34 notice localhost mcpd[5555]: Pool /Common/Pool_Lync_edge_50003 member /Common/APL01:50003 monitor status down. [ /Common/tcp_3_10_50003: down; last error: /Common/tcp_3_10_50003: Unable to connect. @2020/11/24 04:06:34.  ]  [ was up for 0hr:50mins:57sec ] 
ltm 11-23 19:06:36 notice localhost mcpd[5555]: Pool /Common/Pool_Lync_edge_50003 member /Common/APL01:50003 monitor status up. [ /Common/tcp_3_10_50003: up ]  [ was down for 0hr:0min:2sec ] 

tmsh show sys log ltm 으로 Local Traffic Log 를 확인가능하지만,

여기서도 GUI 에서 확인가능한 정도의 Buffer 만 확인가능합니다.

 

 

grep  을 이용해 필요한 문구만 필터링할 수 있습니다.

 

(tmos)# show sys log ltm | grep TEXT

jinhyun1@(SVR_L4_1)(cfg-sync In Sync)(Active)(/Common)(tmos)# show sys log ltm | grep Exch
ltm 11-23 21:47:44 notice localhost mcpd[5555]: Pool /Common/Pool_Exchange_50000 member /Common/KR02:0 monitor status down. [ /Common/tcp_3_10_50000: down; last error: /Common/tcp_3_10_50000: No successful responses received before deadline. @2020/11/24 06:47:44.  ]  [ was up for 14hrs:26mins:49sec ] 
ltm 11-23 21:47:47 notice localhost mcpd[5555]: Pool /Common/Pool_Exchange_50000 member /Common/KR02:0 monitor status up. [ /Common/tcp_3_10_50000: up ]  [ was down for 0hr:0min:3sec ] 
ltm 11-23 23:56:10 notice localhost mcpd[5555]: Pool /Common/Pool_Exchange_50000 member /Common/KR01:0 monitor status down. [ /Common/tcp_3_10_50000: down; last error: /Common/tcp_3_10_50000: No successful responses received before deadline. @2020/11/24 08:56:10.  ]  [ was up for 36hrs:7mins:4sec ] 

 

 

 

728x90

 

 

이전 로그 검색 방법

 

지나간 로그는 /var/log 디렉토리 내에서 압축파일 형태로 저장됩니다.

 

tmsh 모드에서는 확인이 불가하며, 기본 모드에서 "cd /var/log" 명령을 통해

log 관련 폴더로 이동 후 폴더 내 파일을 확인합니다.

 

 

cd /var/log

jinhyun1@(SVR_L4_1)(cfg-sync In Sync)(Active)(/Common)(tmos)# quit
[jinhyun1@SVR_L4_1:Active:In Sync] / # cd /var/log
[jinhyun1@SVR_L4_1:Active:In Sync] log # ls -al
total 12652
drwxrwxrwx. 2 root      root          4096 2016-12-08 15:11 adm
-rw-------. 1 root      root             0 2020-10-18 03:17 apm
-rw-------. 1 root      root         32099 2020-10-17 20:03 apm.1
-rw-------. 1 root      root           123 2020-10-18 03:17 apm.2.gz
-rw-------. 1 root      root         14388 2020-11-24 14:41 ltm
-rw-------. 1 root      root         28943 2020-11-24 02:41 ltm.1
-rw-------. 1 root      root          2497 2020-11-16 03:44 ltm.10.gz
-rw-------. 1 root      root          2214 2020-11-15 03:26 ltm.11.gz
-rw-------. 1 root      root          1947 2020-11-14 03:41 ltm.12.gz
-rw-------. 1 root      root          1983 2020-11-13 03:20 ltm.13.gz
-rw-------. 1 root      root          2204 2020-11-12 03:39 ltm.14.gz
-rw-------. 1 root      root          1914 2020-11-11 03:48 ltm.15.gz

log 폴더 내에는 ltm 외에도 모든 종류의 log 가 저장되며,

기본값으로 8일 동안의 Log 를 저장합니다.

특정 기간이 지난 log 는 *.gz 형태의 압축파일로 약 2MB 용량으로 분할 저장됩니다.

 

 

cat ltm

[jinhyun1@SVR_L4_1:Active:In Sync] log # cat ltm
Nov 24 03:14:05 localhost info audit_forwarder: audit_forwarder started.
Nov 24 03:15:33 localhost notice mcpd[5555]: 01070638:5: Pool /Common/Pool_Lync_edge_50003 member /Common/APL:50003 monitor status down. [ /Common/tcp_3_10_50003: down; last error: /Common/tcp_3_10_50003: Unable to connect. @2020/11/24 03:15:33.  ]  [ was up for 44hrs:24mins:4sec ]
Nov 24 03:15:37 localhost notice mcpd[5555]: 01070727:5: Pool /Common/Pool_Lync_edge_50003 member /Common/APL:50003 monitor status up. [ /Common/tcp_3_10_50003: up ]  [ was down for 0hr:0min:4sec ]
Nov 24 04:03:07 localhost notice mcpd[5555]: 01070638:5: Pool /Common/Pool_Lync_5076 member /Common/APL:5076 monitor status down. [ /Common/tcp_3_10_5076: down; last error: /Common/tcp_3_10_5076: No successful responses received before deadline. @2020/11/24 04:03:07.  ]  [ was up for 37hrs:8mins:2sec ]

파일의 내용을 확인할 때는 "show" 명령이 아닌 리눅스의 파일 내용을 확인하는 명령인 "cat" 명령을 사용합니다.

 

 

 

# ls -al *ltm*

[jinhyun1@SVR_L4_1:Active:In Sync] log # ls -al *ltm*
-rw-------. 1 root root 15380 2020-11-24 15:06 ltm
-rw-------. 1 root root 28943 2020-11-24 02:41 ltm.1
-rw-------. 1 root root  2497 2020-11-16 03:44 ltm.10.gz
-rw-------. 1 root root  2214 2020-11-15 03:26 ltm.11.gz
-rw-------. 1 root root  1947 2020-11-14 03:41 ltm.12.gz
-rw-------. 1 root root  1983 2020-11-13 03:20 ltm.13.gz
-rw-------. 1 root root  2204 2020-11-12 03:39 ltm.14.gz
-rw-------. 1 root root  1914 2020-11-11 03:48 ltm.15.gz
-rw-------. 1 root root  2393 2020-11-10 03:43 ltm.16.gz
-rw-------. 1 root root  1933 2020-11-09 03:50 ltm.17.gz
-rw-------. 1 root root  2230 2020-11-08 03:48 ltm.18.gz
-rw-------. 1 root root  2737 2020-11-07 03:44 ltm.19.gz
-rw-------. 1 root root  2044 2020-11-06 03:45 ltm.20.gz
-rw-------. 1 root root  2367 2020-11-05 03:45 ltm.21.gz

도스의 "dir" 명령인 "ls" 명령을 이용하여 ltm 관련 파일만 확인할 수 있습니다.

생성된 날짜를 보고 관련 이벤트를 추측하며 파일 내용을 확인할 수 있습니다.

 

 

# zcat ltm.4.gz

[jinhyun1@SVR_L4_1:Active:In Sync] log # zcat ltm.4.gz
Nov 20 03:41:05 localhost info audit_forwarder: audit_forwarder started.
Nov 20 04:08:41 localhost notice mcpd[5555]: 01070638:5: Pool /Common/Pool_Group_Portal_443 member /Common/GP02:443 monitor status down. [ /Common/tcp_3_10_443: down; last error: /Common/tcp_3_10_443: No successful responses received before deadline. @2020/11/20 04:08:41.  ]  [ was up for 18hrs:19mins:16sec ]
Nov 20 04:08:46 localhost notice mcpd[5555]: 01070727:5: Pool /Common/Pool_Group_Portal_443 member /Common/GP02:443 monitor status up. [ /Common/tcp_3_10_443: up ]  [ was down for 0hr:0min:5sec ]
Nov 20 04:46:27 localhost notice mcpd[5555]: 01070638:5: Pool /Common/Pool_Group_Portal_control member /Common/DS11:443 monitor status down. [ /Common/tcp_3_10_443: down; last error: /Common/tcp_3_10_443: Unable to connect. @2020/11/20 04:46:27.  ]  [ was up for 16hrs:20mins:17sec ]
Nov 20 04:46:32 localhost notice mcpd[5555]: 01070727:5: Pool /Common/Pool_Group_Portal_control member /Common/DS11:443 monitor status up. [ /Common/tcp_3_10_443: up ]  [ was down for 0hr:0min:5sec ]
Nov 20 05:17:32 localhost notice mcpd[5555]: 01070638:5: Pool /Common/Pool_Group_Portal_443 member /Common/GP02:443 monitor status down. [ /Common/tcp_3_10_443: down; last error: /Common/tcp_3_10_443: No successful responses received before deadline. @2020/11/20 05:17:32.  ]  [ was up for 1hr:8mins:46sec ]

*.gz으로 압축된 파일은 "cat" 명령이 아닌, "zcat" 명령으로 파일 내용을 읽을 수 있습니다.

cat 이나 show 명령과 동일하게 grep 으로 특정 문구만 Filtering 해서 볼 수 있습니다.

 

 

 

 

♥읽어주셔서 감사합니다♥
티스토리 댓글과 공감♥은 로그인이 필요 없습니다.
로그인하시면 구독 가능합니다.