The audit log (/var/log/audit) records configuration changes made on the BIG-IP system, including:
Who made the change (user account)
What was changed (for example, a virtual server modification)
When the change occurred
How it was performed (GUI, TMSH, or API)
Why the other options are incorrect:
/var/log/secure logs authentication events such as login successes and failures, not configuration changes.
/var/log/ltm logs traffic-management and runtime LTM events, not administrative configuration modifications.
Therefore, the correct log file for tracking who changed a virtual server is /var/log/audit.
Contribute your Thoughts:
Chosen Answer:
This is a voting comment (?). You can switch to a simple comment. It is better to Upvote an existing comment if you don't have anything to add.
Submit