# Useful F5 Log Queries

### Introduction

If you work with F5 BIG-IP you maybe need to know for example when a cluster failover has happened or a user has done some changes.

The following will describe some useful F5 log queries which you can use on the F5 logs or any central syslog server you're sending the F5 logs to.

All possible F5 Log Messages can be found here:  
[https://techdocs.f5.com/kb/en-us/products/big-ip\_ltm/releasenotes/related/log-messages.html](https://techdocs.f5.com/kb/en-us/products/big-ip_ltm/releasenotes/related/log-messages.html)

### F5 LTM Log Queries

Check in the Admin UI at System - Logs: Local Traffic

<table class="table-striped" id="bkmrk-research-smartlog-qu"><tbody><tr><th scope="col">Research</th><th scope="col">Log Query</th></tr><tr><td>***Show cluster switchover of a F5 BIG-IP***

See here:

[01340001 : HA Connection with peer %la:%d for traffic-group %s established](https://techdocs.f5.com/kb/en-us/products/big-ip_ltm/releasenotes/related/log-messages.html#A01340001)

[01340002 : HA Connection with peer %la:%d for traffic-group %s lost](https://techdocs.f5.com/kb/en-us/products/big-ip_ltm/releasenotes/related/log-messages.html#A01340002)

</td><td>***HA Connection with peer***

<span class="t"><span class="t a h">Example output:</span></span>

> <span class="t">Apr</span> <span class="t">8</span> <span class="t">07:56:42</span> bigip1 <span class="t">err</span> <span class="t">slot1</span> <span class="t">tmm3</span>\[<span class="t">20728</span>\]<span class="t">:</span> <span class="t">01340001:3:</span> <span class="t a"><span class="t">HA</span> <span class="t">Connection</span> <span class="t">with</span> <span class="t">peer</span></span> <span class="t">1.2.3.4:32770</span> <span class="t">for</span> <span class="t">traffic-group</span> <span class="t">/Common/traffic-group-1</span> <span class="t h"><span class="t">established.</span></span>

</td></tr><tr><td>***TMM is very busy or is stalled.***

See here:

[K10095: Error Message: Clock advanced by &lt;number&gt; ticks](https://my.f5.com/manage/s/article/K10095)

Any value higher than 1000 does show a problem with too high load.

</td><td>***Clock advanced by***

Example output:

> Apr 8 16:12:59 bigip1 notice slot1 tmm\[18639\]: 01010029:5: Clock advanced by 103 ticks

</td></tr><tr><td>***A Virtual Server is under high load***

See here:

[01010038 : Syncookie counter %d exceeded vip threshold %u for virtual = %A:%d](https://techdocs.f5.com/kb/en-us/products/big-ip_ltm/releasenotes/related/log-messages.html#A01010038)

If the message shows multiple times there's maybe an attack going on or a high load on the Virtual Server.

</td><td>***Syncookie counter***

Example output:

> <span class="t">Mar</span> <span class="t">21</span> <span class="t">09:24:33</span> bigip1 <span class="t">warning</span> <span class="t">slot1</span> <span class="t">tmm1</span>\[<span class="t">20805</span>\]<span class="t">:</span> <span class="t">01010038:4:</span> <span class="t a"><span class="t">Syncookie</span> <span class="t">counter</span></span> <span class="t">1500</span> <span class="t">exceeded</span> <span class="t">vip</span> <span class="t">threshold</span> <span class="t">1499</span> <span class="t">for</span> <span class="t">virtual</span> <span class="t">=</span> <span class="t">1.2.3.4:443</span>

</td></tr><tr><td>***Pool Member change***

See here:

[01010221 : Pool %s now has available members](https://techdocs.f5.com/kb/en-us/products/big-ip_ltm/releasenotes/related/log-messages.html#A01010221)

The pool may have had no available members due to administrative action, monitors, connection limits, or other constraints on pool member selection.

</td><td>***now has available members***

Example output:

> <span class="t">Apr</span> <span class="t">8</span> <span class="t">16:33:53</span> bigip1 <span class="t">notice</span> <span class="t">slot1</span> <span class="t">tmm1</span>\[<span class="t">18800</span>\]<span class="t">:</span> <span class="t">01010221:5:</span> <span class="t">Pool</span> <span class="t">/Common/pool\_MyPool</span> <span class="t a"><span class="t">now</span> <span class="t">has</span> <span class="t">available</span> <span class="t">members</span></span>

</td></tr><tr><td>***Status change detected on Pool***

See here:

[01070727 : "Pool %s member %s:%u monitor status up."](https://techdocs.f5.com/kb/en-us/products/big-ip_ltm/releasenotes/related/log-messages.html#A01070727)

This message is logged when a status change is detected for the pool member.

</td><td>***monitor status up***

Example output:

> <span class="t">Apr</span> <span class="t">8</span> <span class="t">16:17:42</span> bigip1 <span class="t">notice</span> <span class="t">slot1</span> <span class="t">mcpd</span>\[<span class="t">5587</span>\]<span class="t">:</span> <span class="t">01070727:5:</span> <span class="t">Pool</span> <span class="t">/Common/pool\_MyPool</span> <span class="t">member</span> <span class="t">/Common/\_auto\_1.2.3.4:443</span> <span class="t a"><span class="t">monitor</span> <span class="t">status</span> <span class="t">up</span></span>. \[ <span class="t">/Common/https\_Monitor:</span> <span class="t">up</span> \] \[ <span class="t">was</span> <span class="t">down</span> <span class="t">for</span> <span class="t">0hr:1min:59sec</span> \]

</td></tr><tr><td>***Machine Boot or mcpd restart***

***See here:***

[01070427 : Initialization complete. The MCP is up and running](https://techdocs.f5.com/kb/en-us/products/big-ip_ltm/releasenotes/related/log-messages.html#A01070427)

the **mcpd** process generates this message during the normal boot process after the configuration loads and **mcpd** reaches a running phase.

***Services are down when mcpd is restarted.***

</td><td>***The MCP is up and running***

Example output:

> notice mcpd\[&lt;PID&gt;\]: 01070427:5: Initialization complete. The MCP is up and running

</td></tr></tbody></table>

### F5 Audit Log Queries

Check in the Admin UI at System - Logs: Audit: List

<table class="table-striped" id="bkmrk-research-smartlog-qu-1" style="width: 100%;"><tbody><tr><th scope="col" style="width: 30.8718%;">Research</th><th scope="col" style="width: 69.1282%;">Log Query</th></tr><tr><td style="width: 30.8718%;">***Show which user has done changes***</td><td style="width: 69.1282%;">***<span class="t">transaction</span>***

<span class="t">Example output:</span>

> <span class="t">client tmui, user username@bigip1 - transaction #1067178-8 - object 0 - create { pool\_member { pool\_member\_pool\_name "/Common/pool\_name" pool\_member\_node\_name "/Common/node1" pool\_member\_port 9020 pool\_member\_inherit\_profile 1 pool\_member\_update\_status 1 pool\_member\_priority 0 pool\_member\_ratio 1 pool\_member\_conn\_limit 0 pool\_member\_addr 1.2.3.4 } } \[Status=Command OK\]:</span>

</td></tr></tbody></table>