F5BigLogProfile¶

Overview¶

The F5BigLogProfile Custom Resource (CR) is used to specify traffic processing events that the Traffic Management Microkernel (TMM) should capture, and send to one or more remote logging servers. The F5BigLogProfile specifically handles events that occur when TMM is processing traffic with any of the Protection BIG-IP Next for Kubernetes CRs. The F5BigLogHslpub CR specifies the remote logging destination IP address and service port, and the logging format. The F5BigLogHslpub CR should be configured and installed first, and then referenced in the F5BigLogProfile CR configuration.

Parameters¶

metadata¶

Parameter	Description
`name`	The unique name identifying the resource (Kubernetes object name). Example: `my-logprofile`.
`namespace`	The Kubernetes namespace in which the resource is created.

spec¶

Parameter	Description	Default	Support for BIG-IP Next for Kubernetes (DPU)
`name`	Specifies the user defined name for the log profile. This name is used to identify and reference the log profile configuration within the system.	`""`	Yes
`publisher`	Specifies the name of the log publisher used for logging events. The publisher defines where and how log messages are sent and processed.	`""`	Yes
`nat`	Specifies the Network Address Translation (NAT) logging configuration. This includes settings for enabling NAT logging, LSN legacy mode, subscriber ID logging, rate limiting, and publisher name.	`{}`	No
`firewall`	Specifies the firewall logging configuration. This section controls various firewall-related logging features including network events, port misuse, IP intelligence, and traffic statistics.	`{}`	Yes
`dns`	Enables or disables DNS logging. If enabled, DNS query and response messages are logged.	`{}`	No
`protocolInspection`	Specifies the configuration for protocol inspection logging. Protocol inspection provides detailed analysis and logging of network protocols for security monitoring and troubleshooting purposes.	`{}`	No
`algLogging`	Specifies the configuration for Application Layer Gateway (ALG) logging. ALG logging provides detailed information about application-specific protocol handling and connection management.	`{}`	No
`pe`	Specifies the configuration for Policy Enforcement (PE) logging. PE logging provides detailed information about policy enforcement decisions and actions for traffic monitoring and compliance reporting.	`{"reportingType": "disabled"}`	No

firewall¶

Parameter	Description	Default
`enabled`	Specifies whether to enable or disable firewall logging. When enabled, firewall events will be logged according to the configured settings.	`false`
`flowspec`	Specifies the configuration for logging Flowspec events.	`{}`
`ipIntelligence`	Specifies the configuration for logging IP Intelligence events.	`{}`
`trafficStats`	Enables or disables logging of traffic statistics events.	`{}`
`portMisuse`	Specifies the configuration for logging port misuse events.	`{}`
`network`	Specifies the configuration for logging network firewall events.	`{}`
`flowspec`	Specifies whether to enable or disable firewall logging. When enabled, firewall events will be logged according to the configured settings.	`false`
`flowspec.publisher`	Specifies the name of the log publisher used for logging Firewall Flowspec events.	`""`
`ipIntelligence`	Specifies the configuration for logging IP Intelligence events. IP Intelligence provides threat detection based on IP reputation and geographic location.	`{}`
`ipIntelligence.publisher`	Specifies the name of the log publisher used for logging IP Intelligence events.	`""`
`ipIntelligence.geo`	Enables or disables logging of the geo location for IP intelligence shun events.	`true`
`ipIntelligence.rtbh`	Enables or disables logging of the Remote Triggered Black Hole (RTBH) events.	`true`
`ipIntelligence.scrubber`	Enables or disables logging of IP intelligence scrubber events.	`true`
`ipIntelligence.shun`	Enables or disables logging of IP intelligence shun events.	`true`
`ipIntelligence.translation`	Enables or disables logging of IP intelligence translation events.	`false`
`ipIntelligence.aggregateRate`	Specifies a rate limit for all combined IP Intelligence log messages per second.	`4294967295`
`trafficStats`	Enables or disables logging of the number of active flows on the client side. The number of flows is logged globally, per virtual server and per route domain periodically if the number of active flows increases or decreases.	`{}`
`trafficStats.activeFlows`	Enables or disables logging of the number of active flows on the client side.	`true`
`trafficStats.reapedFlows`	Enables or disables logging of the number of reaped flows on the client side.	`true`
`trafficStats.missedFlows`	Enables or disables logging of the number of TCP packets (non SYN/ACK) that were dropped because the flow table lookup failed.	`true`
`trafficStats.synCookies`	Enables or disables the logging of the number of syncookies generated, accepted, and rejected globally and per virtual server.	`true`
`trafficStats.syncookiesWhitelist`	Enables and disables logging of the number of syncookies whitelist hits, accepted and rejected globally and per virtual server.	`true`
`trafficStats.publisher`	Specifies the name of the log publisher to use to log traffic statistics.	`""`
`portMisuse`	Specifies the configuration for logging port misuse events. Port misuse detection helps identify when ports are being used for unauthorized or suspicious activities.	`{}`
`portMisuse.publisher`	Specifies the name of the log publisher used for logging port misuse events.	`""`
`portMisuse.aggregateRate`	Specifies a rate limit for all combined port misuse log messages per second.	`4294967295`
`network`	Specifies the configuration for logging network firewall events. This includes ACL matches, IP errors, TCP events, and various network-related logging settings.	`{}`
`network.publisher`	Specifies the name of the log publisher used for logging network events.	`""`
`network.aggregateRate`	Specifies a rate limit for all combined network log messages per second.	`4294967295`
`network.events`	Specifies the network events to be logged. The default is to log all events.	`{}`
`network.ratelimit`	Specifies the rate limits for different types of network events.	`{}`
`network.format`	Specifies the format for network log messages.	`{type: "none"}`
`network.events`	Specifies the network events to be logged.	`{}`
`network.events.aclMatchAccept`	Enables or disables the logging of packets that match ACL rules configured with the actions Accept or Accept Decisively.	`true`
`network.events.aclMatchDrop`	Enables or disables the logging of packets that match ACL rules configured with the action Drop.	`true`
`network.events.aclMatchReject`	Enables or disables the logging of packets that match ACL rules configured with the action Reject.	`true`
`network.events.ipErrors`	Specifies to enable or disable the logging of IP error packets.	`true`
`network.events.tcpErrors`	Specifies to enable or disable the logging of TCP error packets.	`true`
`network.events.tcpEvents`	Specifies to enable or disable the logging of TCP events.	`false`
`network.events.translationFields`	Specifies to enable or disable the logging of translation fields in network log messages.	`false`
`network.events.userAlways`	Specifies to enable or disable the logging of user information in network log messages.	`false`
`network.events.geoAlways`	Enables or disables the logging of Geographic IP location information fields in ACL match and TCP logging.	`false`
`network.events.uuidField`	Enables or disables the logging of the ACL rule UUID field in ACL match and ACL match and TCP logging.	`false`
`network.events.aclToBoxDeny`	Enables or disables the logging of traffic that is coming to management IP address. If drop or reset log is already enabled, enabling this field creates one more log.	`false`
`network.ratelimit`	Specifies the rate limits for different types of network events. These limits control how many log messages per second are generated for each event type.	`{}`
`network.ratelimit.aclMatchAccept`	Rate limit for the logging of packets that match ACL rules configured with the actions Accept or Accept Decisively.	`4294967295`
`network.ratelimit.aclMatchDrop`	Rate limit for the logging of packets that match ACL rules configured with the action Drop.	`4294967295`
`network.ratelimit.aclMatchReject`	Rate limit for the logging of packets that match ACL rules configured with the action Reject.	`4294967295`
`network.ratelimit.ipErrors`	Specifies the rate limit for the logging of IP error packets.	`4294967295`
`network.ratelimit.tcpErrors`	Specifies the rate limit for the logging of TCP error packets.	`4294967295`
`network.ratelimit.tcpEvents`	Specifies the rate limit for the logging of TCP events.	`4294967295`
`network.format`	Specifies the format for network log messages.	`{type: "none"}`
`network.format.type`	Specifies the format type for network log messages.	`"none"`
`network.format.userDefinedFieldList`	Specifies user-defined field list for custom network logging format (for example, `${date_time},${protocol},${src_ip},${dst_ip}`).	`""`
`network.format.networkFieldList`	Specifies the network field list configuration for network log messages.	`{}`
`network.format.networkFieldList.delimiter`	Specifies the delimiter character used to separate fields in the network log message output for proper formatting.	`","`
`network.format.networkFieldList.items`	Specifies the individual fields to be included in the network log messages for detailed logging information.	`[]`

Sample CRs for F5BigLogHslpub and F5BigLogProfile¶

Install the F5BigLogHslpub CR:

apiVersion: k8s.f5net.com/v1
kind: F5BigLogHslpub
metadata:
  name: hsl-publisher
  namespace: f5-bnk
spec:
  pool:
    -
      name: hsl-pool
      endpoint:
        - 11.19.10.100:514
  syslog:
    -
      name: syslog
      format: rfc5424
      protocol: tcp
      pool: hsl-pool

Install the F5BigLogProfile CR:

apiVersion: k8s.f5net.com/v2
kind: F5BigLogProfile
metadata:
  name: "logprofile"
  namespace: f5-bnk
spec:
  publisher: "hsl-publisher"
  firewall:
    enabled: true
    network:
      events:
        aclMatchAccept: true
        aclMatchDrop: true
        aclMatchReject: true

Attach the LogProfile to Gateway/GatewayClass/Gateway Listener in SecPolicy CR.

apiVersion: "gateway.k8s.f5.com/v1alpha1"
kind: SecPolicy
metadata:
  name: secpolicy-global
  namespace: f5-bnk
spec:
  extensionRefs:
  - kind: F5BigLogProfile
    name: logprofile
    group: k8s.f5net.com
  targetRefs:
  - kind: GatewayClass
    name: f5-gateway-class
    group: gateway.networking.k8s.io

The log message indicates that the F5BigLogProfile CR was added/updated:

kubectl create -f logprofile.yaml
f5biglogprofile.k8s.f5net.com/logprofile created

kubectl get -f logprofile.yaml
NAME         READY   MESSAGE                                AGE
logprofile   True    CR config sent to all grpc endpoints   2s

kubectl describe -f logprofile.yaml
..
Status:
  Conditions:
    Last Transition Time:  2026-03-18T13:41:02Z
    Message:
    Observed Generation:   0
    Reason:                Accepted
    Status:                True
    Type:                  Accepted
    Last Transition Time:  2026-03-18T13:41:02Z
    Message:               CR config sent to all grpc endpoints
    Observed Generation:   2
    Reason:                Programmed
    Status:                True
    Type:                  Programmed
  Generation Id:           0
Events:
  Type    Reason         Age   From               Message
  ----    ------         ----  ----               -------
  Normal  Added/Updated  22s   f5-cne-controller  LogProfile alpha/logprofile was added/updated

F5BigLogProfile: Example of user-defined field list¶

apiVersion: "k8s.f5net.com/v1"
kind: F5BigLogProfile
metadata:
  name: "log-profile"
  namespace: f5-bnk
spec:
  firewall:
    enabled: true
    network:
      publisher: "hsl-publisher"
      events:
        aclMatchAccept: true
        aclMatchDrop: true
        aclMatchReject: true
        translationFields: true
      format:
        type: user-defined
        userDefinedFieldList: "DateTime:${date_time},Host:${bigip_hostname},MgmtIP:${management_ip_address},FwPolicy:${acl_policy_name},SrcIP:${src_ip},SrcPort:${src_port},DstIP:${dest_ip},DstPort:${dest_port},TrSrcIP:${translated_src_ip},TrDstIP:${translated_dest_ip},TrSrcPort:${translated_src_port},TrDstPort:${translated_dest_port},Protocol:${protocol},Action:${action},Context:${context_name}"

F5BigLogProfile: Example of field-list¶

apiVersion: "k8s.f5net.com/v1"
kind: F5BigLogProfile
metadata:
  name: "log-profile"
  namespace: f5-bnk
spec:
  firewall:
    enabled: true
    network:
      publisher: "hsl-publisher"
      events:
        aclMatchAccept: true
        aclMatchDrop: true
        aclMatchReject: true
        translationFields: true
      format:
        type: field-list
        networkFieldList:
          delimiter: ";"
          items:
            - "date_time"
            - "bigip_hostname"
            - "management_ip_address"
            - "acl_policy_name"
            - "src_ip"
            - "src_port"
            - "dest_ip"
            - "dest_port"
            - "translated_src_ip"
            - "translated_dest_ip"
            - "translated_src_port"
            - "translated_dest_port"
            - "protocol"
            - "action"
            - "context_name"