Forum Discussion

LoanBMT's avatar
LoanBMT
Icon for Nimbostratus rankNimbostratus
Oct 01, 2015

ASM Event log with local storage

Hi all,   May you help me the way to extend local data storage volume for ASM Event logs? I have been using default profile named "Log illegal requests" in TMOS 11.6, and I don't have remote stora...
application delivery
deployment
monitor
performance
storage
TMSH
Hannes_Rapp_162's avatar
Hannes_Rapp_162
Icon for Nacreous rankNacreous

You can modify the DB log-rotate value from the default of 8 days to 30, this should also cover for /var/log/asm and ASM logs in GUI. Note that there are no guarantees you will always have the backlog for 30 days. If you run out of disk space in /var/log folder, the actual number of days for which you will have the logs will be less.

Increasing log-age value

tmsh modify sys db logrotate.logage value 30
tmsh save sys config

If you would like to increase the disk space for /var/log folder, you can also do it from TMSH; that procedure (Extending disk space for increased logging) is documented in this article: https://support.f5.com/kb/en-us/solutions/public/14000/900/sol14952.htmlproc3

Hannes_Rapp_162's avatar
Hannes_Rapp_162
Icon for Nacreous rankNacreous
Oct 06, 2015
Hello, Sorry for the late reply. The link you gave me also includes a solution which is reverting to pre-11.6 behaviour. However, due to performance issues, it seems like F5 is looking to more aggressively push their clients towards a Remote ASM Logging solution. It does make sense and we've already ditched Local ASM Logging a while ago, only issue is that Remote Logging does not enable you to log POST parameters as was possible with Local Logging (ASM intenal DB). Quoting from the link you gave me: "Beginning in BIG-IP ASM 11.6.0, enhancements were introduced to improve system performance and stability. As a result, the system no longer writes security events to syslog by default and it does not log them locally to the /var/log/asm file. You may enable the send_content_events internal parameter to replicate the old behavior. However, F5 recommends leaving it disabled due to a potential decrease in performance." Would it suffice if you enable the "send_content_events", as recommended in this article, or is it not an option? I'm afraid there are no good alternatives for ASM Local Logging from 11.6 onwards. At least, you would have the logs for a greater number of days in /var/log/asm.x files.