For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

dubdub's avatar
dubdub
Icon for Nimbostratus rankNimbostratus
Mar 22, 2012

APM session archiving

Is it possible to archive old session data in APM? We are looking at spinning up a few new policies that will hammer us with session data, and I am concerned about being able to query it succinctly (as well as not have my gear get overloaded). I haven't been able to find anything of this nature on Ask-F5 or DC... if it exists somewhere, please redirect me!

 

 

Thanks,

 

Jen

 

app sec
BIG-IP Access Policy Manager (APM)
security

4 Replies

  • hoolio's avatar
    hoolio
    Icon for Cirrostratus rankCirrostratus
    Mar 23, 2012
    Hi Jen,

     

     

    I wonder if you could trigger the ACCESS_POLICY_AGENT_EVENT iRule event from the VPE, retrieve the session variable(s) using ACCESS::session data get and then log them remotely using High Speed Logging:

     

     

    https://devcentral.f5.com/wiki/iRules.HSL.ashx

     

     

    Aaron
  • dubdub's avatar
    dubdub
    Icon for Nimbostratus rankNimbostratus
    Mar 23, 2012
    Hey Aaron,

     

     

    I'd sure be open to using HSL to offload the querying - though I am still concerned about local storage for all this data. https://support.f5.com/kb/en-us/solutions/public/11000/500/sol11559.html?sr=20284390 seems to indicate that its possible for data to accumulate pretty extensively; does it roll off automatically based on some criteria?

     

     

    Thanks,

     

    Jen
  • hoolio's avatar
    hoolio
    Icon for Cirrostratus rankCirrostratus
    Mar 23, 2012
    I think there is some type of database clearing process, but I don't know the mechanics of this. You could try opening a case with F5 Support or contact your F5 SE to get more info.

     

     

    Aaron
  • dubdub's avatar
    dubdub
    Icon for Nimbostratus rankNimbostratus
    Mar 24, 2012
    Hey Aaron,

     

     

    I did open a case, and confirmed there is no built-in archival of the APM session data. I am putting in a feature request for it. Thanks very much for the advice!

     

     

    Thanks,

     

    Jen