ASM - Reporting Illegal Requests

Hi Saito,

 

 

Are you trying to make changes to the ASM policy or get a list of violations that ASM has found in client requests? I don't think there is much granular functionality for making changes to a policy via iControl or retrieving forensics. You can configure a remote syslog server for ASM forensics, or you could configure them to log locally and modify alertd to send this via SNMP to a remote host.

 

 

I'm sure F5 ASM Product Development would like to hear more about what you're trying to implement so they can consider adding functionality to the product. To let them know, you can open a support case with F5.

 

 

Aaron

Hi Hoolio.

 

 

 

Thanks for your reply.

 

 

I'm trying to get a list of violations that ASM has logged. The same information we can find under "Reporting" tab on ASM. Since our GUI is based on iControl I was looking for a method to call it. But now that you told me about syslog, I think that this information can be reached through asm logs.

 

 

Since those logs can show thousands of entries, capturing logs through iControl could be not a good idea after all.

 

 

 

Thanks!

 

 

Saito

I think you're right. The ASM forensics database can contain millions of records. I think you're right that per violation reporting being pushed from the box is better than trying to pull all records.

 

 

Aaron