F5BigLogProfile¶

Overview¶

Function¶

Declares a log profile for a CNE instance, defining logging configuration for NAT, firewall, DNS, protocol inspection, Application Layer Gateway (ALG), and Policy Enforcement (PE) events.

Names¶

Singular name	Plural name	Short name
f5-big-log-profile	f5-big-log-profiles	logprof

API group and version¶

k8s.f5net.com/v2

Scope¶

Namespace

Specification¶

spec¶

Field	Required	Default	Description
`name` string	No	`""`	User-defined name for the log profile. This name identifies and references the log profile configuration within the system. Maximum length is 255 characters.
`publisher` string	No	`""`	Name of the log publisher used for logging events. The publisher defines where and how log messages are sent and processed. Maximum length is 255 characters.
`nat` object	No	`{}`	Network Address Translation (NAT) logging configuration.
`firewall` object	No	`{}`	Firewall logging configuration.
`dns` object	No	`{}`	DNS logging configuration.
`protocolInspection` object	No	`{}`	Protocol inspection logging configuration.
`algLogging` object	No	`{}`	Application Layer Gateway (ALG) logging configuration.
`pe` object	No	`{"reportingType": "disabled"}`	Policy Enforcement (PE) logging configuration.

spec.nat¶

Field	Required	Default	Description
`enabled` boolean	No	`false`	Turns NAT logging on or off. Accepted values: `true`, `false`.
`lsnLegacyMode` boolean	No	`false`	Turns on LSN legacy mode, which uses the legacy CGNAT/LSN logging facility instead of the firewall NAT logging capability. LSN legacy mode is limited compared to firewall NAT logging. Accepted values: `true`, `false`.
`logSubscriberID` boolean	No	`false`	Logs the subscriber ID associated with a subscriber IP address. Accepted values: `true`, `false`.
`aggregateRateLimit` integer	No	`4294967295`	Rate limit for all combined NAT log messages per second. Beyond this rate limit, the system doesn’t log messages until the rate drops below the limit. Accepted values: 0 to 4294967295.
`publisher` string	No	`""`	Name of the log publisher used for logging NAT events. Maximum length is 255 characters.
`outbound` object	No	`{}`	Logging configuration for outbound NAT translation events.
`inbound` object	No	`{}`	Logging configuration for inbound NAT translation events.
`quotaExceeded` object	No	`{"formatType": "none"}`	Logging configuration for NAT quota exceeded events.
`errors` object	No	`{"formatType": "none"}`	Logging configuration for NAT error events.

spec.nat.outbound¶

Field	Required	Default	Description
`start` object	No	`{"formatType": "none"}`	Generates event log entries at the start of the translation event for a NAT client, when the outbound session is created.
`end` object	No	`{"formatType": "none"}`	Generates event log entries at the end of the translation event for a NAT client, when the outbound session is freed.

spec.nat.outbound.start¶

Field	Required	Default	Description
`mode` string	No	`enabled`	Mode for outbound session start logging. Accepted values: `disabled`, `enabled`, `backup`.
`includeDestAddrPort` boolean	No	`true`	Includes the destination address and port in the logs when the outbound session start mode is `enabled`. Accepted values: `true`, `false`.
`ratelimit` integer	No	`4294967295`	Rate limit for outbound NAT log messages per second. Accepted values: 0 to 4294967295.
`formatType` string	No	`none`	Format type for the outbound NAT log messages. Accepted values: `none`, `field-list`, `user-defined`. When set to `field-list`, set `fieldList.items`. When set to `user-defined`, set `userDefinedFieldList`.
`fieldList` object	No	`{}`	Field list for the outbound NAT log messages.
`userDefinedFieldList` string	No	`""`	User-defined field list for a custom logging format, for example `${timestamp},${event_name},${src_ip},${dst_ip}`. Maximum length is 1024 characters.

spec.nat.outbound.end¶

Field	Required	Default	Description
`mode` string	No	`enabled`	Mode for outbound session end logging. Accepted values: `disabled`, `enabled`, `backup`.
`includeDestAddrPort` boolean	No	`true`	Includes the destination address and port in the logs when the outbound session end mode is `enabled`. Accepted values: `true`, `false`.
`ratelimit` integer	No	`4294967295`	Rate limit for outbound NAT log messages per second. Accepted values: 0 to 4294967295.
`formatType` string	No	`none`	Format type for the outbound NAT log messages. Accepted values: `none`, `field-list`, `user-defined`. When set to `field-list`, set `fieldList.items`. When set to `user-defined`, set `userDefinedFieldList`.
`fieldList` object	No	`{}`	Field list for the outbound NAT log messages.
`userDefinedFieldList` string	No	`""`	User-defined field list for a custom logging format. Maximum length is 1024 characters.

spec.nat.inbound¶

Field	Required	Default	Description
`start` object	No	`{"formatType": "none"}`	Generates event log entries at the start of the incoming connection event for a translated endpoint, when the inbound session is created.
`end` object	No	`{"formatType": "none"}`	Generates event log entries at the end of the incoming connection event for a translated endpoint, when the inbound session is terminated.

spec.nat.inbound.start¶

Field	Required	Default	Description
`mode` string	No	`enabled`	Mode for inbound session start logging. Accepted values: `disabled`, `enabled`, `backup`.
`ratelimit` integer	No	`4294967295`	Rate limit for inbound NAT log messages per second. Accepted values: 0 to 4294967295.
`formatType` string	No	`none`	Format type for inbound NAT log messages. Accepted values: `none`, `field-list`, `user-defined`. When set to `field-list`, set `fieldList.items`. When set to `user-defined`, set `userDefinedFieldList`.
`fieldList` object	No	`{}`	Field list for the inbound NAT log messages.
`userDefinedFieldList` string	No	`""`	User-defined field list for a custom logging format. Maximum length is 1024 characters.

spec.nat.inbound.end¶

Field	Required	Default	Description
`mode` string	No	`enabled`	Mode for inbound session end logging. Accepted values: `disabled`, `enabled`, `backup`.
`ratelimit` integer	No	`4294967295`	Rate limit for inbound NAT end log messages per second. Accepted values: 0 to 4294967295.
`formatType` string	No	`none`	Format type for inbound NAT end log messages. Accepted values: `none`, `field-list`, `user-defined`. When set to `field-list`, set `fieldList.items`. When set to `user-defined`, set `userDefinedFieldList`.
`fieldList` object	No	`{}`	Field list for the inbound NAT end log messages.
`userDefinedFieldList` string	No	`""`	User-defined field list for a custom logging format. Maximum length is 1024 characters.

spec.nat.outbound.start.fieldList¶

Field	Required	Default	Description
`items` array	No	`[]`	Fields to include in the outbound NAT log messages. Accepted values: `action`, `bigip_hostname`, `date_time`, `management_ip_address`, `context_name`, `dest_ip`, `dest_port`, `event_name`, `protocol`, `route_domain`, `src_ip`, `src_port`, `sub_id`, `timestamp`, `translated_dest_ip`, `translated_dest_port`, `translated_route_domain`, `translated_src_ip`, `translated_src_port`.
`delimiter` string	No	`,`	Delimiter used to separate fields in the log message. Must be 1 to 2 characters.

Note

The fieldList object under spec.nat.inbound.start, spec.nat.inbound.end, spec.nat.outbound.end, spec.nat.quotaExceeded, and spec.nat.errors uses the same items and delimiter fields. The outbound and inbound end field lists also accept duration. The quotaExceeded and errors field lists accept translation_error and translation_object in place of the translated address fields.

spec.nat.quotaExceeded¶

Field	Required	Default	Description
`mode` string	No	`enabled`	Mode for quota exceeded logging. Accepted values: `disabled`, `enabled`, `backup`.
`ratelimit` integer	No	`4294967295`	Rate limit for quota exceeded log messages per second. Accepted values: 0 to 4294967295.
`formatType` string	No	`none`	Format type for quota exceeded log messages. Accepted values: `none`, `field-list`, `user-defined`. When set to `field-list`, set `fieldList.items`. When set to `user-defined`, set `userDefinedFieldList`.
`fieldList` object	No	`{}`	Field list for the quota exceeded log messages.
`userDefinedFieldList` string	No	`""`	User-defined field list for a custom logging format. Maximum length is 1024 characters.

spec.nat.errors¶

Field	Required	Default	Description
`mode` string	No	`enabled`	Mode for error logging. Accepted values: `disabled`, `enabled`, `backup`.
`ratelimit` integer	No	`4294967295`	Rate limit for error log messages per second. Accepted values: 0 to 4294967295.
`formatType` string	No	`none`	Format type for error log messages. Accepted values: `none`, `field-list`, `user-defined`. When set to `field-list`, set `fieldList.items`. When set to `user-defined`, set `userDefinedFieldList`.
`fieldList` object	No	`{}`	Field list for the error log messages.
`userDefinedFieldList` string	No	`""`	User-defined field list for a custom logging format. Maximum length is 1024 characters.

spec.firewall¶

Field	Required	Default	Description
`enabled` boolean	No	`false`	Turns firewall logging on or off. Accepted values: `true`, `false`.
`flowspec` object	No	`{}`	Logging configuration for Flowspec events. Flowspec is a BGP extension for flow-based traffic filtering and rate limiting.
`ipIntelligence` object	No	`{}`	Logging configuration for IP intelligence events.
`trafficStats` object	No	`{}`	Logging configuration for traffic statistics.
`portMisuse` object	No	`{}`	Logging configuration for port misuse events.
`network` object	No	`{}`	Logging configuration for network firewall events.

spec.firewall.flowspec¶

Field	Required	Default	Description
`publisher` string	No	`""`	Name of the log publisher used for logging firewall Flowspec events. Maximum length is 255 characters.

spec.firewall.ipIntelligence¶

Field	Required	Default	Description
`publisher` string	No	`""`	Name of the log publisher used for logging IP intelligence events. Maximum length is 255 characters.
`geo` boolean	No	`true`	Turns on logging of the geographic location for IP intelligence shun events. Accepted values: `true`, `false`.
`rtbh` boolean	No	`true`	Turns on logging of Remote Triggered Black Hole (RTBH) events. RTBH filtering drops undesirable traffic before it enters a protected network. Accepted values: `true`, `false`.
`scrubber` boolean	No	`true`	Turns on logging of IP intelligence scrubber events. Scrubber events indicate when traffic scrubbing services process traffic. Accepted values: `true`, `false`.
`shun` boolean	No	`true`	Turns on logging of IP intelligence shun events. Shun events occur when the system blocks traffic from suspicious IP addresses. Accepted values: `true`, `false`.
`translation` boolean	No	`false`	Turns on logging of IP intelligence translation events. Accepted values: `true`, `false`.
`aggregateRate` integer	No	`4294967295`	Rate limit for all combined IP intelligence log messages per second. Accepted values: 0 to 4294967295.

spec.firewall.trafficStats¶

Field	Required	Default	Description
`activeFlows` boolean	No	`true`	Turns on logging of the number of active flows on the client side. Accepted values: `true`, `false`.
`reapedFlows` boolean	No	`true`	Turns on logging of the number of reaped flows on the client side. Accepted values: `true`, `false`.
`missedFlows` boolean	No	`true`	Turns on logging of the number of TCP packets (non-SYN/ACK) dropped because the flow table lookup failed. Accepted values: `true`, `false`.
`synCookies` boolean	No	`true`	Turns on logging of the number of SYN cookies generated, accepted, and rejected. Accepted values: `true`, `false`.
`syncookiesWhitelist` boolean	No	`true`	Turns on logging of the number of SYN cookie allowlist hits, accepted and rejected. Accepted values: `true`, `false`.
`publisher` string	No	`""`	Name of the log publisher used to log traffic statistics. Maximum length is 255 characters.

spec.firewall.portMisuse¶

Field	Required	Default	Description
`publisher` string	No	`""`	Name of the log publisher used for logging port misuse events. Maximum length is 255 characters.
`aggregateRate` integer	No	`4294967295`	Rate limit for all combined port misuse log messages per second. Accepted values: 0 to 4294967295.

spec.firewall.network¶

Field	Required	Default	Description
`publisher` string	No	`""`	Name of the log publisher used for logging network events. Maximum length is 255 characters.
`aggregateRate` integer	No	`4294967295`	Rate limit for all combined network log messages per second. Accepted values: 0 to 4294967295.
`events` object	No	`{}`	Network events to log.
`ratelimit` object	No	`{}`	Rate limits for each type of network event.
`format` object	No	`{"type": "none"}`	Format for network log messages.

spec.firewall.network.events¶

Field	Required	Default	Description
`aclMatchAccept` boolean	No	`true`	Turns on logging of packets that match ACL rules with the Accept or Accept Decisively action. Accepted values: `true`, `false`.
`aclMatchDrop` boolean	No	`true`	Turns on logging of packets that match ACL rules with the Drop action. Accepted values: `true`, `false`.
`aclMatchReject` boolean	No	`true`	Turns on logging of packets that match ACL rules with the Reject action. Accepted values: `true`, `false`.
`ipErrors` boolean	No	`true`	Turns on logging of IP error packets. Accepted values: `true`, `false`.
`tcpErrors` boolean	No	`true`	Turns on logging of TCP error packets. Accepted values: `true`, `false`.
`tcpEvents` boolean	No	`false`	Turns on logging of TCP events. Accepted values: `true`, `false`.
`translationFields` boolean	No	`false`	Turns on logging of translation fields in network log messages. Accepted values: `true`, `false`.
`userAlways` boolean	No	`false`	Turns on logging of user information in network log messages. Accepted values: `true`, `false`.
`geoAlways` boolean	No	`false`	Turns on logging of geographic IP location fields in ACL match and TCP logging. Accepted values: `true`, `false`.
`uuidField` boolean	No	`false`	Turns on logging of the ACL rule UUID field in ACL match and TCP logging. When the `acl_rule_uuid` field is explicitly set in a field list or user-defined format, the system logs the UUID regardless of this option. Accepted values: `true`, `false`.
`aclToBoxDeny` boolean	No	`false`	Turns on logging of traffic coming to the management IP address. When drop or reset logging is already on, this option creates one more log. Accepted values: `true`, `false`.

spec.firewall.network.ratelimit¶

Field	Required	Default	Description
`aclMatchAccept` integer	No	`4294967295`	Rate limit for logging of packets that match ACL rules with the Accept or Accept Decisively action. Accepted values: 0 to 4294967295.
`aclMatchDrop` integer	No	`4294967295`	Rate limit for logging of packets that match ACL rules with the Drop action. Accepted values: 0 to 4294967295.
`aclMatchReject` integer	No	`4294967295`	Rate limit for logging of packets that match ACL rules with the Reject action. Accepted values: 0 to 4294967295.
`ipErrors` integer	No	`4294967295`	Rate limit for logging of IP error packets. Accepted values: 0 to 4294967295.
`tcpErrors` integer	No	`4294967295`	Rate limit for logging of TCP error packets. Accepted values: 0 to 4294967295.
`tcpEvents` integer	No	`4294967295`	Rate limit for logging of TCP events. Accepted values: 0 to 4294967295.

spec.firewall.network.format¶

Field	Required	Default	Description
`type` string	No	`none`	Format type for network log messages. Accepted values: `none`, `field-list`, `user-defined`. When set to `field-list`, set `networkFieldList.items`. When set to `user-defined`, set `userDefinedFieldList`.
`userDefinedFieldList` string	No	`""`	User-defined field list for a custom network logging format, for example `${date_time},${protocol},${src_ip},${dst_ip}`. Maximum length is 1024 characters.
`networkFieldList` object	No	`{}`	Field list for network log messages.

spec.firewall.network.format.networkFieldList¶

Field	Required	Default	Description
`delimiter` string	No	`,`	Delimiter used to separate fields in the network log message. Must be 1 to 2 characters.
`items` array	No	`[]`	Fields to include in the network log messages. Each field is a string of up to 255 characters.

spec.dns¶

Field	Required	Default	Description
`enabled` boolean	No	`false`	Turns DNS logging on or off. Accepted values: `true`, `false`.
`description` string	No	`""`	User-defined description for the DNS logging configuration. Maximum length is 255 characters.
`queryLogging` boolean	No	`true`	Turns on logging of DNS query messages. Accepted values: `true`, `false`.
`responseLogging` boolean	No	`false`	Turns on logging of DNS response messages. Accepted values: `true`, `false`.
`combinedLogging` boolean	No	`false`	Combines DNS query and response logging into a single log message. This overrides the individual options. Accepted values: `true`, `false`.
`completeAnswer` boolean	No	`true`	Includes the complete answer section in the DNS response messages. Accepted values: `true`, `false`.
`queryId` boolean	No	`false`	Includes the query ID in the DNS query and response messages. Accepted values: `true`, `false`.
`source` boolean	No	`true`	Includes the log message originator in the query and response messages. Accepted values: `true`, `false`.
`timeStamp` boolean	No	`true`	Includes the timestamp in the DNS query and response messages. Accepted values: `true`, `false`.
`view` boolean	No	`true`	Includes the DNS view in the query and response messages. Accepted values: `true`, `false`.
`publisher` string	No	`""`	Name of the log publisher used for DNS log messages. Maximum length is 255 characters.

spec.protocolInspection¶

Field	Required	Default	Description
`enabled` boolean	No	`false`	Turns protocol inspection logging on or off. Accepted values: `true`, `false`.
`publisher` string	No	`""`	Name of the `F5BigLogHslpub` resource used for protocol inspection log messages. Maximum length is 255 characters.
`logPacket` boolean	No	`false`	Turns on logging of the packet payload that matches the protocol inspection profile. Accepted values: `true`, `false`.

spec.algLogging¶

Field	Required	Default	Description
`enabled` boolean	No	`false`	Turns on the ALG logging feature. Accepted values: `true`, `false`.
`publisher` string	No	`""`	Name of the `F5BigLogHslpub` resource used for ALG log messages. Maximum length is 255 characters.
`csvFormat` boolean	No	`false`	Generates log entries in comma-separated values (CSV) format. Accepted values: `true`, `false`.
`dataChannel` object	No	`{}`	Logging configuration for ALG data channel events.
`controlChannel` object	No	`{}`	Logging configuration for ALG control channel events.

spec.algLogging.dataChannel¶

Field	Required	Default	Description
`start` object	No	`{}`	Logging configuration for data channel start events, when a data channel connection is established.
`end` object	No	`{}`	Logging configuration for data channel end events, when a data channel connection is terminated.

spec.algLogging.controlChannel¶

Field	Required	Default	Description
`start` object	No	`{}`	Logging configuration for control channel start events, when a control channel connection is established.
`end` object	No	`{}`	Logging configuration for control channel end events, when a control channel connection is terminated.

Note

Each start and end object under spec.algLogging.dataChannel and spec.algLogging.controlChannel accepts a mode field (accepted values: disabled, enabled; default disabled) and an includeDestAddrPort field (accepted values: true, false; default false).

spec.pe¶

Field	Required	Default	Description
`reportingType` string	Yes	`disabled`	Type of PE reporting. Accepted values: `session-reporting`, `flow-reporting`, `disabled`. The `reportingFields` values depend on this type.
`reportingFields` array	No	`[]`	Fields to include in PE reports. The accepted values depend on `reportingType`.
`usageVolumeThreshold` object	No	`{}`	Usage volume thresholds that trigger PE reports.
`intervalThreshold` integer	No	`0`	Interval threshold, in seconds, for generating periodic reports. When set to `0`, periodic reporting is off. Accepted values: 0 to 4294967295.
`formatScript` string	No	`""`	Script that formats the log messages. The script runs on the BIG-IP system and customizes the log message format. Maximum length is 65520 characters.

spec.pe.usageVolumeThreshold¶

Field	Required	Default	Description
`downLink` integer	No	`0`	Downlink data volume threshold, in bytes, that triggers a PE report. Accepted values: 0 to 4294967295.
`upLink` integer	No	`0`	Uplink data volume threshold, in bytes, that triggers a PE report. Accepted values: 0 to 4294967295.
`total` integer	No	`0`	Combined uplink and downlink data volume threshold, in bytes, that triggers a PE report. Accepted values: 0 to 4294967295.

Sample Manifests for F5BigLogHslpub and F5BigLogProfile¶

Install the F5BigLogHslpub resource:

apiVersion: k8s.f5net.com/v1
kind: F5BigLogHslpub
metadata:
  name: hsl-publisher
  namespace: f5-bnk
spec:
  pool:
    -
      name: hsl-pool
      endpoint:
        - 11.19.10.100:514
  syslog:
    -
      name: syslog
      format: rfc5424
      protocol: tcp
      pool: hsl-pool

Install the F5BigLogProfile resource:

apiVersion: k8s.f5net.com/v2
kind: F5BigLogProfile
metadata:
  name: "logprofile"
  namespace: f5-bnk
spec:
  publisher: "hsl-publisher"
  firewall:
    enabled: true
    network:
      events:
        aclMatchAccept: true
        aclMatchDrop: true
        aclMatchReject: true

Attach the F5BigLogProfile to spec.targetRefs Gateway/GatewayClass/Gateway Listener in a SecPolicy resource.

apiVersion: "gateway.k8s.f5.com/v1alpha1"
kind: SecPolicy
metadata:
  name: secpolicy-global
  namespace: f5-bnk
spec:
  extensionRefs:
  - kind: F5BigLogProfile
    name: logprofile
    group: k8s.f5net.com
  targetRefs:
  - kind: GatewayClass
    name: f5-gateway-class
    group: gateway.networking.k8s.io

The log message indicates that the F5BigLogProfile resource was added/updated:

kubectl create -f logprofile.yaml
f5biglogprofile.k8s.f5net.com/logprofile created

kubectl get -f logprofile.yaml
NAME         READY   MESSAGE                                AGE
logprofile   True    CR config sent to all grpc endpoints   2s

kubectl describe -f logprofile.yaml
..
Status:
  Conditions:
    Last Transition Time:  2026-03-18T13:41:02Z
    Message:
    Observed Generation:   0
    Reason:                Accepted
    Status:                True
    Type:                  Accepted
    Last Transition Time:  2026-03-18T13:41:02Z
    Message:               CR config sent to all grpc endpoints
    Observed Generation:   2
    Reason:                Programmed
    Status:                True
    Type:                  Programmed
  Generation Id:           0
Events:
  Type    Reason         Age   From               Message
  ----    ------         ----  ----               -------
  Normal  Added/Updated  22s   f5-cne-controller  LogProfile alpha/logprofile was added/updated

user-defined Field List Manifest¶

apiVersion: "k8s.f5net.com/v1"
kind: F5BigLogProfile
metadata:
  name: "log-profile"
  namespace: f5-bnk
spec:
  firewall:
    enabled: true
    network:
      publisher: "hsl-publisher"
      events:
        aclMatchAccept: true
        aclMatchDrop: true
        aclMatchReject: true
        translationFields: true
      format:
        type: user-defined
        userDefinedFieldList: "DateTime:${date_time},Host:${bigip_hostname},MgmtIP:${management_ip_address},FwPolicy:${acl_policy_name},SrcIP:${src_ip},SrcPort:${src_port},DstIP:${dest_ip},DstPort:${dest_port},TrSrcIP:${translated_src_ip},TrDstIP:${translated_dest_ip},TrSrcPort:${translated_src_port},TrDstPort:${translated_dest_port},Protocol:${protocol},Action:${action},Context:${context_name}"

field-list Manfest¶

apiVersion: "k8s.f5net.com/v1"
kind: F5BigLogProfile
metadata:
  name: "log-profile"
  namespace: f5-bnk
spec:
  firewall:
    enabled: true
    network:
      publisher: "hsl-publisher"
      events:
        aclMatchAccept: true
        aclMatchDrop: true
        aclMatchReject: true
        translationFields: true
      format:
        type: field-list
        networkFieldList:
          delimiter: ";"
          items:
            - "date_time"
            - "bigip_hostname"
            - "management_ip_address"
            - "acl_policy_name"
            - "src_ip"
            - "src_port"
            - "dest_ip"
            - "dest_port"
            - "translated_src_ip"
            - "translated_dest_ip"
            - "translated_src_port"
            - "translated_dest_port"
            - "protocol"
            - "action"
            - "context_name"

Example manifest¶

apiVersion: k8s.f5net.com/v1
kind: F5BigLogHslpub
metadata:
  name: hsl-publisher
  namespace: f5-bnk
spec:
  pool:
    -
      name: hsl-pool
      endpoint:
        - 11.19.10.100:514
  syslog:
    -
      name: syslog
      format: rfc5424
      protocol: tcp
      pool: hsl-pool