Applicaton security logs stopped

Yes, this looks OK. At least it's running.

Do you see anything odd in the log?

Did you check the steps and values mentioned in K05372587 and K06821426?

Also, since remote logging is working, there are two more simple checks you could perform.

• Did you create qkview and upload to ihealth? If yes, did this reveal something obvious?
• Do you have a cluster? Can you do a failover and check if local logging is working on the other node?

Check like this

ps | grep asmlogd
 
tail -f var/log/ts/asmlogd.log

I got sth like

 9237 ?       S<  308:12 /usr/bin/perl /usr/share/ts/bin/asmlogd

16505 pts/0   S+    0:00 grep asmlogd

I have run below command

mysql -uasm -p`perl -MF5::Cfg -e 'print F5::Cfg::get_mysql_password()'` -e "select COUNT(*) from PRX.REQUEST_LOG"

In active node : count 0

and in standby : count 5xxx

so it seems the issue with the active node, i will try to offline the active node to double check.

when the active node forced to be standby , the logs are display on the other node and works as expected. so the issue with the node, but how to investigate the root cause and how to solve it?

I have mentioned a couple of steps above.

1. Qkview and upload to ihealth
2. Check var/log/ts/asmlogd.log
3. Check if, maybe, you are affected by a known issue like: K93091504: Cannot see any event logs for BIG-IP ASM. Security logging stopped working or similar issues.
4. Open a case with F5

restart asmlogd will cause any issue ?

pkill -f pabnagd

and pkill -f asmlogd

or better to use tmsh restart /sys service asm ?

If this node is still in standby, it is safe to apply this procedure.

However, I am from the school that would rather like to figure out the root cause before I restart daemons. Did you find any log entry that points to a known bug, that can be worked around by restarting pabnagd and asmlogd?

according to https://support.f5.com/csp/article/K93091504 it might be the issue ,

but i'm not able to view pabnagd.log to check if there is any warning.

However, in security > Event Logs > Application > Requests it display empty no message is displayed.