Hello Everyone, Greetings!I've been trying to configure email notifcation when ASM L7 DoS event is triggered in F5 BIG-IP. And as far the configration goes are mentioned below:Created an iRule and attached to virtual server.when IN_DOSL7_ATTACK { log local0. "Attacker IP: $DOSL7_ATTACKER_IP" log local0. "Mitigation: $DOSL7_MITIGATION" #DOSL7::disable } I enabled the Trigger iRule on DoS profile of ASM module and the DoS profile attached to its respective virtual server. When I performed the DoS attack using locust tool on the F5 virtual ip then on the dosl7d.log, the attack was recorded -On GUI On CLI: but there was simply just two entry on the /var/log/ltm The iRule used is Just a quick questions:- Do i need to have additional configuraiton, or am i expecting the wrong entry of the DoS event on the ltm log?- Regarding the behavioral DoS detection,Any idea like what are the parameters does the behavioral dos monitors and then triggers it on F5 BIG-IP.SInce the actual code or logic to identify and trigger behavioral dos is kept in a compiled mode.

Hi Nishal_Rai , For your inquiry about how bigip AWAD L7 DDoS use the rate-limit prevention.....Well , First you have two concepts >>> Detection interval & historical interval Detection interval >>> Avg of TPS in last 10 secHistorical interval >>> Avg of TPS in last 1 hour ( Which should be the Legitimate TPS ) Both of intervals updated each 10 sec. Bigip Rate-limit by using simple equation : ( Historical intrval TPS + Configured threshold ) /2 For Example : If you configured absolute threshold >> 200 TPS ( Like diagram you have sent above ). and Let we assume historical intraval ( AVG TPS within hour ) >>> 100 TPS So Bigip will rate-limit to 150 TPS. Bigip will rate-limit if the TPS exceeded the absolute threshold , or if the ( Relative threshold + at least TPS ) violated. > btw , you can review it from logs when attack started you can observe the Limit which bigip used when this attack started. >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>What is the Rate-limit mechanism , I have tested it before I will tell you my findings >>> you have an option to record traffic in your AWAF DDOS profile , Bigip starts to record traffic ( Taking tcpdump ). while looking at recorded Packet capture ( when Attack started ) you will find much traffic receiving RST Packets from Bigip and some samples receive normal responses ( 200 OK ) therefore when using ( Rate-limit ) as a prevension method >>> much traffic will be Reseted from Bigip ip while some of these requests will path through bigip normally. The Key difference between ( Block ALL and Rate limit ) >>> Block all will show you at Recorded Packet capture file when attack start >> All Traffic from specific source are reseted ( RST Flag enabled ) no traffic Path through bigip , in the other hand ( Rate-limit ) Like I discribed above. Let me know if you have further queries , I will be happy to think with you ^_^

ASM L7 DoS email alert

Forum Discussion

DevCentral Quicklinks

* Getting Started on DevCentral
* Community Guidelines
* Community Terms of Use / EULA
* Community Ranking Explained
* Community Resources
* Contact the DevCentral Team
* Update MFA on account.f5.com

Discover DevCentral Connects

* Podcasts
* Social Channels
* Video Streaming

GitHub Awesome-F5

Forum Discussion

SSO Login Update Coming to DevCentral

Kevin - June 2026 Featured F5er

Tyler - May 2026 Featured Member

Recent Discussions

What configuration issue am I experiencing with this 130-domain VS ?

F5 System Scanner - How I deployed it at scale

Ivanti MDM Core & F5 LTM/ASM with mTLS

F5 BIGIP & XC certbot plugin

Hardware BIG-IP appliance reach EOSS, but the software version running on it not yet?

Related Content

Certificate Expiry Email alert configuration

SSL Certificate Alerts via Email

F5 BIG-IP Automatic email notification for system update events (ASM/AWAF)

Remove alerts showing r-series LCD/Dashboard.

ASM ser input type email doesn't allow valid emails

ABOUT DEVCENTRAL

RESOURCES

SUPPORT

PARTNERS