Purpose
This guide explains how to send the DNS query and response logs of an F5 BIG-IP DNS (formerly GTM) system to Logsign USO via syslog. BIG-IP DNS writes these logs through a DNS Logging profile and a log publisher. Logsign parses each query and response line and records the client address, the queried name, the response code and the answer.
Prerequisites
- An administrator account on the BIG-IP Configuration utility that can create pools, log destinations, log publishers and DNS profiles.
- Network connectivity from the BIG-IP system to the Logsign USO collector on your syslog port (UDP 514 by default).
Step 1: Configure DNS Logging on BIG-IP DNS
Menu names can differ slightly between BIG-IP versions. If a path below does not match your system, check F5's documentation on configuring DNS logging with a remote syslog destination.
- Go to Local Traffic > Pools and create a pool that contains the Logsign USO collector as its only member, using the IP address of the collector and your syslog port.
- Go to System > Logs > Configuration > Log Destinations and create a destination of type Remote High-Speed Log that points to this pool. Select the protocol that your Logsign syslog listener uses (UDP by default).
- Create a second destination of type Remote Syslog. Set Syslog Format to RFC 5424 (Syslog) and set Forward To to the Remote High-Speed Log destination from the previous step.
- Go to System > Logs > Configuration > Log Publishers and create a publisher that uses the Remote Syslog destination.
- Go to DNS > Delivery > Profiles > Other > DNS Logging and create a DNS Logging profile. Select the log publisher you created, and enable Log Queries and Log Responses.
- Go to DNS > Delivery > Profiles > DNS, open the DNS profile that your DNS listeners use, set Logging to Enabled, select the DNS Logging profile as the Logging Profile and save.
Step 2: Add the Data Source in Logsign USO
- Add a new syslog source in Logsign USO.
- Select F5 as the vendor and BIG-IP DNS as the product.
- Enter the IP address that the BIG-IP system sends its logs from.
- Save the source.
Supported Log Formats
Logsign accepts the BIG-IP DNS query and response lines in two forms. The first is the RFC 5424 form produced by a Remote Syslog destination, where the DNS message follows a syslog header that carries the tmm process ID and an [F5@12276] structured data block:
1 2026-09-23T10:53:16.474179+03:00 f5-1.example.local tmm 14820 - [F5@12276] 2026-09-23 10:53:16 f5-1.example.local from 198.51.100.16#63629: view none: query: www.example.com IN A -EDC (10.0.0.10%0)
1 2026-09-23T10:55:12.621677+03:00 f5-1.example.local tmm 14820 - [F5@12276] 2026-09-23 10:55:12 f5-1.example.local to 203.0.113.57#38641: [NOERROR qr,aa,cd,do] response: www.example.com. 900 IN A 192.0.2.10;
The second is the DNS message on its own, without a syslog header. In this form the line can also contain the DNS query ID (qid), which the DNS Logging profile adds when Include Query ID is enabled:
2022-12-21 14:24:00 dns01.example.local qid 19877 from 198.51.100.67#19814: view none: query: www.example.com IN A -EDC (10.0.0.253%1)
The query ID is optional in both forms. Other lines that the BIG-IP system sends to the same destination, such as system or configuration messages, are not recognized by this parser.
What Gets Collected
| Logsign Field | Content |
|---|---|
| Time.Generated | Date and time inside the DNS message, for example 2026-09-23 10:53:16 |
| EventSource.HostName | Name of the BIG-IP system from the DNS message, for example f5-1.example.local |
| Source.IP, Source.Port | Address and port of the DNS client. For queries this is the address after from, for responses the address after to. |
| Event.Action | DNS view of the query, for example view none (query lines only) |
| DNS.Query | Queried name, class, type, flags and listener address, for example www.example.com IN A -EDC (10.0.0.10%0) (query lines only) |
| DNS.ResponseCode | Response code, for example NOERROR or NXDOMAIN (response lines only) |
| DNS.Response | Answer section of the response, or empty when there is no answer (response lines only) |
| Vserver.IP | For queries, the listener address in parentheses. For responses, the address of the last A record in the answer. Responses without an A record at the end, such as empty or CNAME answers, leave this field blank. |
| Process.PID | In the RFC 5424 form, the tmm process ID from the syslog header. In the form without a header, the DNS query ID (qid) when it is present. |
Every event is recorded with Vendor F5, Product BIG-IP DNS, EventSource Type Security Systems, Category DNS Server and EventMap Network / DNS / Info.
Notes and Limits
- All BIG-IP DNS events are recorded with the same severity (Severity.ID
6, Severity.Nameinformation). NXDOMAIN and other error responses are not raised to a higher severity, so use DNS.ResponseCode when you build alerts on failed lookups. - In the RFC 5424 form, Process.PID holds the
tmmprocess ID. If you enable Include Query ID with this form, the query ID is not stored in a separate field. - Each DNS message must arrive as a single syslog message on a single line.