Log Formats

This document details about the log formats for TMM< CNF Controller and CNF CWC.

TMM

Log Format

The TMM logs include the version, log type, log level, Args, and message in key-value pair format.

"v"="<version>";"lt"="<log-type>";"l"="<log-level/severity>";"Arg1"="<value1>";"Arg2"="<value2>";"m"="<message>"

Example

May 10 08:44:32 f5-tmm-7f5d9dfbc5-nw2xp -l=6[13]: 014c0022:4: "v"="1.0";"lt"="U";"l"="warning";"IP"="10.33.0.90";"Port"="8050";"m"="DIAMETER: Forced down pool member 10.33.0.90:8050 as BIG-IP received DPR from it"

Supported TMM Keys

The table below list the supported TMM keys:

Key Names Description
AccessPolicyName Name of access policy.
Action Action to be taken like Policy binding, updation, deletion, allocate, clone, release, free, etc.
ActivationID ActivationID for policy binding.
ActualValue Common Key for the actual or current value for comparing with Min and Max Values.
AgentName Agent Name for HTTP.
AlterdDestination Altered Destination Address.
ApplicationId Diameter Application ID.
ApprovedOrNot Has a value: "approved" or "not approved".
AttackID Identifier to identify the attack.
AttackName Identifier to identify the name of an attack.
AttackType This is identified as the type of attack that will have values like Simulated, Enforced, DNS, NETWORK, etc.
Attempts Number of attempts like timer, heartbeat, routing, etc.
AvpDetail Diameter protocol AVP name and its length.
AvpLength Diameter protocol AVP length.
AvpMaxLength Diamter protocol AVP Max Length.
BufferLength Length of Buffer.
Bus PCI-e Bus.
BZIP2Enabled bzip2 data compressor enabled.
CallID PPTP Call Request/Start/End ID.
Cause Cause.
CertificateName Name of X509 certificate.
ChannelKey Plugin Channel Key.
CipherSuiteID Cipher Suite ID.
CipherSuiteName Cipher Suite Name.
ClientStateName ICAP client-facing state transition.
Clientkey SIP media flow creation client key
CmpDestpg CMP destination pg.
CmpDestpu CMP destination pu.
CmpNodepg CMP node pg.
CmpNodepu CMP node pu.
CmpState CMP state.
CommonName X509 certificates common name.
ConcurrentSessionPerSubscriber SIP protocol concurrent session per subscriber.
ConfigAttribute Diameter protocol configuration attribute.
ConfiguredRouterProfileLimit MRF(Message Routing Framework) Configured router profile limit.
ConnFlow Connection Flow which represents IP and port of endpoint.
ConnectionFlowID Connection flow ID.
ConnFlowSide Connflow side. Like: ServerSide or ClientSide.
ConnectionReuseEnabled iSession Enabled Connection Reuse.
Connections Syncookie embryonic connection counter.
ConnectionCycles Number of connection cycles.
Connector Connector protocol connector.
Context Context.
ContextName Context Name.
ControlMessage PPTP control message.
CookieState Cookie State.
Count Count.
Counter Standard Counter Counting some number. Like no of packets, messages, errors, etc.
CustomizationName Customization Name for Access Policy.
DateCenter Data Center Name.
DatagroupName Data group name.
DBError Database error.
DebugLog Log that gives info about the code flow status.
DedupControlConnection Dedup Control Connection.
DedupEnabled Dedup Enabled.
DeflateEnabled Deflate Enabled.
Delay Delay time in seconds.
Detection BDoS Detection.
DeviceName F5 Device Name.
DNS Domain Name Service.
DNSCache Domain Name Service Cache Name.
DNSCacheType Domain Name Service Cache Type.
DNSQuery Domain Name Service Query.
DNSZoneName Domain Name Service Zone Name.
Domain Service Based Interface Domain.
DNSRecord Domain Name Service DS Record.
EndToEndId Diameter protocol end to end header value.
Error Error code or Error Type.
ErrorPhrase Error Phrase.
ErrorDescription This is a generic keyname for error description.
ErrorMessage This is a generic keyname for error messages.
Event Generic key used for different events.
EventType Event type for configuration add/delete.
ExternalEvent External Event.
ExpirationValue Expiration Value.
Feature Feature Flag or feature.
File File name.
FilterCount Filter Count.
FlowID TMM connection flow ID.
FlowRedirectStats CMP flow redirect stats.
Flowtype Connection flow type.
FlowIndex Message Routing SIP Flow Index.
FQDN Fully qualified domain name.
FQDNCatMask FQDN IP interface cat mask.
FQDNId FQDN Id.
Fragments IP fragments.
FunctionName Used when function name is used in the log message.
GaugeLevel Gauge level for diameter logs.
GeoEventType Sessiondb entry related event type sent though kafka.
GenerationID Generation ID.
GeoMessageBrokerTmmLog Geo redundancy tmm log.
GUPI iSession GUPI.
HARole HA Role will denote the role specified in the log. Like: active, standby, unknown, etc
HeaderId Header ID.
HeaderLength Header Length.
HeaderName Header Name.
HeaderSize Header size.
HeaderType Header Type.
HeaderValue Header Value.
HigigData CMP Higig Data.
Histogram Histogram.
HistogramReferenceCount Histogram Reference Count.
HopByHopId Diameter hop by hop ID header value.
HSBModID HSB module ID.
HttpActionCode HTTP Action Code for ev shutdown, abort, etc.
HTTPContentEncoding HTTP Content.
HudMessageName Hud Message Name.
HudNode Hud Node.
ID Identifier.
Index Index.
Information Information.
InterfaceName Interface name.
IP IP Address.
IPHeaderLength IP Header Length.
IPProto IP Proto.
IPPORTSeperator IPPort Seperator, in case of IPV4 it will be : and IPV6 it will be.
iRuleEvent iRule Event.
iRuleName iRule Name.
iRuleAbortedLogRatio iRule Aborted Log Ratio.
Issuer x509 certificate issuer Name.
PCPInternalPort PCP Internal Port.
PCPExternalPort PCP External Port.
PCPInternalIP PCP Internal IP.
PCPExternalIP PCP External IP.
IVSName Internal Virtual Server.
IVSResultNumber IVS Result Number.
IVSResultName IVS Result Name.
IVSResultDesc IVS Result Description.
LBName Load Balance Name.
LBcName GSLB LBc name.
LDNS GSLB LDNS
Length Length
LicenseTag License Tag.
Lifetime Lifetime of a packet, message, etc.
Line Line number.
LinkName Link Name.
LinkSpeed Link Speed.
Listener Listener.
LogDestination Log Destination. Example: FsLog Destination, HSL Destination, Syslog Destination etc.
LogDestinationRouteDomain Log Destination Route Domain.
LogMessageBuffer Log Message Buffer.
LogName Log Name
LZOEnabled LZO Enabled.
MacAddress MAC Address.
Master Master
MaxCacheControlHeaderCount Max cache control header count configured.
MaxHeaderSize Maximum Header Size.
MaxQueueData Max Queue Data.
MaximumLength Maximum allowed bytes.
MaxSessionTimeout Maximum Session Timeout.
MediaCount Media Count
MaxTCL Maximum length of TCL script.
MaxRegistration Maximum Global Registration for subscribers.
MaxRequests Maximum no. of Requests.
MaxRetries Maximum Retries.
MaxRegPerSubscriber Maximum Registrations Per Subscriber.
McpError MCP Error
MaxMediaSessions Maximum Media Sessions.
MemoryAllocationFailure Memory allocation failure point.
Message Message.
MessageID MessageID.
MessageLength Length of Message.
Method Method
MethodID MethodID
MinimumRequiredMode off
MinimumRequiredValue Number or Percentage of pool members required.
MinValue Common Key for minimum value.
Mode Mode
ModID Hardware Mod ID.
MonitorAgentName Monitoring Agent Name.
** MonitorID** Identifier of monitor activity (0 is invalid). May be reused after activity is deleted.
MPIKey MPI key
MRFlowID MRFlow ID
MTU Maximum Transmission Unit
Name Name is used on multiple places as a generic key like operation name, device name, type of function name etc.
NatRule Nat Rule
NeuronApp Neuron App Name.
NeuronClient Neuron Client Name.
NullEnabled Null Enabled.
NumberOfMessages Number of Messages.
Offset Offset Value
Oid Object ID
OperationCode Operation Code
OperationCodeName Operation Code Name.
OperatorTag Operator Tags like Create, Add, Delete, etc.
PCPOption Option specific to PCP logs.
Owner Owner Name. Like NSEC3 owner name etc.
OriginHost Diamter origin-host AVP value.
PacketLength Packet Length
Parent ID Parent ID
Path Path is used to specify where error has occured. Like: /dev/shm/pktclass_nat etc.
PayloadLength Payload Length
PayloadOffset Payload Offset
PayloadSize Payload Size in bytes.
PCPAnnounceType PCP Announce Multicast Type.
PCPMaxMappingLifetime Min mapping lifetime.
PCPMinMappingLiftetime Max mapping lifetime.
PeerDelay Time taken by peer to respond.
PeerDelayCriticalLimit Configured Router profile limit.
PeerEgressMessageRate Peer Egress Message rate.
PeerEgressMessageRateLimit Configured Peer Egress Message rate limit.
PeerIngressMessageRate Peer Ingress message rate.
PeerIngressMessageRateLimit Configured Peer Ingress message rate limit.
PeerName Peer name
PeerRole Role of the Peer. Example: Active, Standby or Unknown.
PeerTimeoutMajor Configured Peer timeout major limit.
PeerUuid Peer Uuid
PersistenceKey Key used for the session persistence.
PluginLog Log related to plugins.
PluginTag Plugin Tag
PodID Pod ID
PolicyItemName Policy Item Name.
PoolID Pool ID
PoolMember Pool Member
PoolMembers PoolMembers
PoolMemberList Pool Member List
PoolMemberGroup Pool Member Group
PoolMemberREM Pool Member rem
PoolMemberStatus Status of the pool member - UP/DOWN
PoolName Pool name
Port Port
PrefixLength Prefix Length
PrefixName Prefix Name for PCP profile.
Priority Priority Number
ProcessingGroup Processing Group of TMM.
ProfileFieldName Name of the parameter in the profile.
ProfileName Profile Name
ProfileOption Profile Option
ProfileUUID Profile UUID
Protocol Protocol Name
Proxy Proxy
QueueData Queue Data
RateLimitCount Rate limit count
Reason Specific reason or any message specifying reason.
RedisRequest Request to Redis DB.
RedisResponse Response given by Redis DB.
RedisResponseLength Redis Response Length.
RegEx Regular Expression
ReqID Request ID
ResolverDName Resolver dname
ResolverType Resolver type
ResolverNumrr Resolver num_rr
ResolverRCode Resolver rcode
ResolverExpires Resolver Expires
ResultCode Diameter result code, DNS Result Code
ResponseCode Response Code
RetransmissionNote Diamter retranmission note
RoutingAttempts No. of Routing attempts.
RouteDomain Route Domain ID
RouteDomainName Route Domain Name.
RouterName Router Name
RouterProfileName Router Profile Name.
RowName tmstat row name.
RRType Load balance rrtype.
RuleName Rule Name
RSTCauseInfo Information related to RST Cause
SecurityKey Security key used for encryption.
SelfIPName SelfIPName
SelfRole Role of the Self Example: Active, Standby or unknown.
SelfUuid Self UUID
Serial Serial Number
ServerName Server Name
ServerStateName Server State Name
ServerKey Server Key
SessionDBKey SessionDB Key
Signal Signal ID or number
SignatureName TMM Signature Name.
Size Size
SizeOfMessages Size of messages.
Slot Slot is generic key used for Interface Slot or PCI Slot.
SnatpoolName Snatpool Name
SplunkDestination Splunk Destination
SplunkSubDestination Splunk Sub Destination
SSLProfile SSL Profile
State State is a generic key used for peer state or self state.
Status Status of the action. Example like Connected to TMM Database etc.
StatusCode StatusCode is generic key used to specify response Status Code from HTTP or ICAP.
Stream Stream
SubnetLength Subnet Length
Subscriber Subscriber
SubscriberURI Subscriber URI
SynCache Syn Cache
SyncookieCounter Syncookie Counter
TableName tmstat Table Name
Tag Generic keyname for tag like Headline Tag.
TCLRule Rule for TCL
TCLRuleEvent TCL rule event
TCLScriptID Plugin TCL Script ID
TemplateID IPFIX Template ID
Threshold Threshold Value
ThresholdMode Threshold Mode
Time Time in seconds, msec, etc.
Timeout Timeout in seconds, msec, etc.
TimeSlot Time Slot
TMMDestinationID TMM Destination ID
TMMSourceID TMM Source ID
TmmThreadID TMM Thread ID
TotalActiveNPUs Total Active NPUs
TotalLength Total Length in bytes.
TotalMessages Total MessagesGeoMessageBrokerTmmLog
TrafficDirection Traffic Direction like ingress or egress.
TrafficGroupName Traffic Group Name
TrafficRate Traffic Rate like packets/sec, msg/sec, bytes/sec.
TrafficRateType Traffic Rate Type
TransmissionMode Transmission Mode like Full Duplex, Half Duplex.
TransportConfigName Transport Config Name.
TransportConfigType Transport Config Type.
TrunkMember Trunk member
TrunkName Trunk Name
TunnelName Tunnel Name
Type This is a generic keyname for Type. Like type of connection, type of error etc.
UUID Universally Unique Identifiers, or UUIDS, are 128 bit numbers.
URI URI
Value Value
VectorState Vector State.
Version Version is used for specifing the version of listener. Values will be like: V1, V2, (DUPLICATE) v1 etc.
VGName VLAN Group Name.
VirtualServer Virtual Server
VirtualServerCount Number of Virtual Servers.
VlanMember Vlan Member
VlanMemberType Vlan Member Type like Interface, Trunk, etc.
VlanName Vlan Name
VlanPriority Vlan Priority
VlanTag Vlan Tag. Like Outer Tag and Inner Tag
VlanType Vlan Type
WOCDControlConnection WOCD Control Connection
DestinationAddress Destination Address
SourceAddress Source Address
DestinationAddressType Type of Destination Address could be Primary / Secondary.
DataType Type of Data
LocalAddress Local Address
RtdomID RtdomID
LocalPort Local Port
RemoteAddress RemoteAddress
RemotePort Remote Port

BIG-IP Controller

The BIG-IP Controller logs include the timestamp, log type, severity, version and message in key-value pair format.

Log Format

Timestamp | Log-Type | Severity | version | Message=""

Examples

2023-06-29 03:13:58.119|C|informational|1|CrKind=F5SPKIngressTCP|CrName=fastl4-nginx|AppNS=dp-apps|Event=CR|Operation=Add
2023-06-29 03:13:58.200|A|informational|1|Message="Adding CR event in sync queue: *v1.F5SPKIngressTCP"

Supported CNF Controller Keys

The table below list the supported CNF Controller keys:

Key Names Description
CrKind CR Kind. Example: F5BigTCPsetting, F5BigUPDSetting, etc.
CrName CR Name. Example: ingress-tcp-1, ingress-udp-1, etc.
CrVersion CR Version
AppNS Application Namespace
SvcName User created Service Name.
F5SvcName Internally created Service Name.
EndpointName Endpoint Name
Message Log statement
ControllerVersion F5ingress controller version
IP IP Address
Port Port
EventWatcher Watcher for each CR per namespace.
Event CR, TMMPod, Service and Endpoint Events based on add/update/delete operations.
Operation Type of Operation like: Add, Update and Delete.
Recipient gRPC message recipients. Example: TMM, IPSD, PCCD
SendConfig Transport type between control plane and data plane. Example: gRPC
ConfigBlocked Based on license status, whether config is blocked or not.
ManageSelfIP SelfIPs being Added/Removed from TMM for vlan.
AnnotateTMM TMM pod annotations are being Added/Removed.
ManageSnatpool SnatPool being Added/Removed from TMM.
CrStatus Status of CR. Example: Deploying, Waiting, Success and Failed.

CNF CWC

The CNF CWC logs include the timestamp, log type, severity, version and message in key-value pair format.

Log Format

Timestamp | Log-Type | Severity | version | Message=""

Example

2023-05-26 06:58:02.691|A|informational|1|Message="Mode configured is connected"

Supported CNF CWC Key

The table below list the supported CNF CWC key:

Key Name Description
Message Log statement

Log Types

The table below list the supported log types:

Log Types Description
C Compliance/Audit
T Transaction
S System
U User
A Application

Log Levels / Severity Levels

The table below list the supported log level / severity levels:

Value Log Level / Severity Level Description
0 Emergency System is unusable
1 Alert Action must be taken immediately
2 Critial Critical conditions
3 Error Error conditions
4 Warning Warning conditions
5 Notice Normal but significant conditions
6 Informational Informational messages
7 Debug Debug-level messages

Feedback

Provide feedback to improve this document by emailing cnfdocs@f5.com.