Forum Discussion

WAF_Monkey's avatar
WAF_Monkey
Icon for Altostratus rankAltostratus
Dec 03, 2020

ASM Chart Numbers Skewed From Event Logs

Under Security >> Reporting:Application:Charts, when viewing by Request Types for the Time Period of "Last Month", I'm seeing vastly different numbers than what the event logs show for the same time period. For example, Blocked requests show 22 in the charts yet show 645,446 in the event logs. I see similar differences for Legal and Alarmed requests. I manage several F5's running ASM and this only occurs on two boxes that are running v14.1.0.6.

 

Has anyone seen this before? Any ideas why this is happening? It's screwing up my monthly metrics! :-(

ASM Advanced WAF
security
  • Samir's avatar
    Samir
    Icon for MVP rankMVP
    Dec 03, 2020

    What I observed, event log count is total raw number of blocked request. However in report 22 are categorised (types). Check the individual WAF policy which has more blocked request via reporting.

    ​

    ​If. Still have issue raise support case.

    ​

    Thanks​

  • Ivan_Chernenkii's avatar
    Ivan_Chernenkii
    Icon for Employee rankEmployee
    Dec 11, 2020

    Data is aggregated into charts with some delay. Most probably if you will look at custom period or last week, then you will see more requests.

    To get full data for last month you need to gather statistics for last 4 weeks.