Forum Discussion

m_soe's avatar
m_soe
Icon for Nimbostratus rankNimbostratus
Jun 15, 2017

ASM - Suppressing a particular log event

I have multiple event logs filling up for the Illegal URL /favicon.ico. The file does not exist.

 

I do not wish to allow the URL and I do not want to see violation logs on that.

 

Is there a way to achieve that?

 

ASM Advanced WAF
security
  • Jad_Tabbara__J1's avatar
    Jad_Tabbara__J1
    Icon for Cirrostratus rankCirrostratus
    Jun 16, 2017

    Hello Mike,

     

    Which logging profiles are you using "Log all requests" or "Log Illegal Requests" ?

     

    I recommend you to use the "Log Illegal Requests".

     

    Does /favicon.ico requests generates incidents ? What are the incidents generated ?

     

    Thanks

     

  • nathe's avatar
    nathe
    Icon for Cirrocumulus rankCirrocumulus
    Jun 16, 2017

    Have you explicitly allowed URLs in your policy? If so, then any other URL not mentioned will generate Illegal URL - which i think is what's happening from your description. You could uncheck the Alarm flag from this violation in the Blocking Settings so you don't get alerts, however, you will no longer get alerts when this violation is triggered, irrespective of the URL (favicon or otherwise).

     

    Alternatively, you could create an iRule or Local Traffic Policy to check the URL and drop/reset if favicon is the destination URI. This way ASM won't see the traffic to create an event log.

     

    Hope this helps.

     

    N