For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

StewartT_232774's avatar
StewartT_232774
Icon for Nimbostratus rankNimbostratus
Nov 05, 2015

ASM Automation (API / MySQL)

I'm running ASM 11.6 with EM 3.1.1. (Mainly used for config backup/pushing signatures)   My syslog feed for security events goes to another group for SIEM processing.   I'm looking to automa...
ASM Advanced WAF
iControlREST
management
security
samstep's avatar
samstep
Icon for Cirrocumulus rankCirrocumulus
Nov 09, 2015

Do you really need the API here? or just the ability to the dump the alerts somewhere you can use them?

 

It is trivial to set up your log publishers in such a way to log locally (be aware of the performance overhead). Or log it remotely to an additional log destination under your control so you can search it for SupportID or insert the log data into your own database there (this can be done easily with something like Kiwi Syslog - http://www.kiwisyslog.com/help/syslog/action_log_to_odbc_database.htm )

 

Don't forget that you can always get your /var/log/asm file back by setting ASM system variable "send_content_events" to 1 in Security/Options/Application Security/Advanced Configuration menu. Beware of the performance impact - there is a reason why F5 has disabled local logging - writing logs to local disk is SLOW, so if you are protecting a high-load website/application you may experience unnecessary latency and CPU increase introduced by local logging.

 

Hope this helps,

 

Sam