Which file should the BIG-IP Administrator check to determine when a Virtual Server changed its status?

The /var/log/ltm file is the primary log for the Local Traffic Manager (LTM) module. It records events related to the status of LTM objects, including virtual servers, pools, and pool members. When a health monitor marks a resource up or down, or when an administrator manually enables or disables an object, the resulting status change of the virtual server is logged in this file. This makes it the correct location to investigate the history of a virtual server's availability.

A. /var/log/audit logs administrative changes to the BIG-IP configuration, not the operational status changes of LTM objects like virtual servers.

B. /var/log/lastlog is a standard Linux file that records the most recent login of users and is unrelated to BIG-IP traffic management objects.

D. /var/log/monitors contains detailed, verbose logging for specific health monitors, which is useful for debugging a monitor but is not the primary log for virtual server status events.

1. F5 Networks. (2021). BIG-IP TMOS: Operations Guide. Chapter 6: Logs and Notifications, Section: BIG-IP system log files. "The /var/log/ltm file logs traffic management-related messages."

2. F5 Knowledge Center. (2022). K16197: Reviewing BIG-IP log files. "The /var/log/ltm file contains information related to the local traffic management system, such as virtual server and pool status, and connection information."

3. F5 Knowledge Center. (2022). K07359145: The BIG-IP system logs messages related to virtual server and pool member status changes to the /var/log/ltm file. This article explicitly states that messages for virtual server status changes are logged to /var/log/ltm.