When a LoadMaster is first added to Kemp 360 Central, the Kemp 360 Central IP address is automatically appended to the existing list of syslog hosts. After this is set, all logs are sent to Kemp 360 Central and can be downloaded using the Kemp 360 Central interface. For more information relating to downloading the logs, refer to the System Logs section.

For a LoadMaster connected to Kemp 360 Central, you can edit the LoadMaster syslog settings using Kemp 360 Central by performing the following steps:

  1. Click the cloud icon on the left of the screen.
  2. Select the System Configuration tab.

  3. Select the LoadMaster with the settings you wish to update.
    Note: When updating the syslog targets for a LoadMaster HA pair, use the shared IP address.
  4. Go to Log Settings.
  5. Expand the Syslog Options section.

  6. Enter the relevant IP addresses of the one or more remote syslog servers in the relevant text boxes. Multiple IP addresses must be separated with a comma.
    Note: You are only able to configure one IP address to one host level. If you try to configure the same IP address that is already set to a syslog host, the IP address host is updated to the new one and you must set a new IP address for the original level. For example, you have the IP address 10.35.60.166 set on the Error Host field. If you type the same IP address in the Critical Host field, when you click Submit, the Critical Host is updated with the new IP address but the Error Host field will now be blank. You will receive a notification to indicate that the change was successful.
  7. Click Submit to save the changes.

The syslog settings are then updated on the selected LoadMaster(s). The Kemp 360 Central view of the LoadMaster Syslog Options always remains correct.

Six different error message levels are defined and each message level may be sent to a different server. Notice messages are sent for information only; Emergency messages normally require immediate user action.

Up to 10 individual IP addresses can be specified for each of the Syslog fields. Multiple IP addresses must be separated by commas.

The following are examples of the type of message that may be seen after setting up a syslog server:

  • Emergency: Kernel-critical error messages
  • Critical: Unit 1 has failed and unit 2 is taking over as master (in a High Availability (HA) setup)
  • Error: Authentication failure for root from 192.168.1.1
  • Warn: Interface is up/down
  • Notice: Time has been synced
  • Info: Local advertised Ethernet address

Syslog messages cascade in an upwards direction. Thus, if a host is set to receive WARN messages, the message file will include message from all levels including and above WARN but none for levels below.

If all six levels are set to the same hostn - multiple messages for the same error are sent to the same host.

Syslog Collection for F5, NGINX, and HAProxy

For F5, NGINX, and HAProxy devices, syslog collection must be enabled manually on the device through the native user interface. Once the device has been added to Kemp 360 Central and Kemp 360 Central is added as a syslog target to the device, Kemp 360 Central automatically starts collecting logs from these devices.

See the documentation for the device to configure remote syslog options to include the Kemp 360 Central IP address. Documentation current at the time this document was last updated is available at these links: