Forum Discussion

Tom_380335's avatar
Tom_380335
Icon for Nimbostratus rankNimbostratus
Jan 02, 2019

ASM log is a part of the central log?

On our production F5 server logs are coming to Splunk but we do not have the ASM deployed yet.

 

We have ASM on our testing machine. Can you tell me if ASM log is a part of the central log?

 

So if all F5 logs goes in the same "bucket"/syslog and Splunk collects it then it's ok, but if ASM log is saved in separate place where can I find it? If I want to send to splunk all log including ASM do I need to configure something on spunk side?

 

Thanks in advance,

 

Tomislav

 

ASM Advanced WAF
security
  • Rico's avatar
    Rico
    Icon for Cirrus rankCirrus
    Jan 02, 2019

    Tomislav,

     

    Here is some documentation on how to setup Splunk logging in F5. It specifically mentions how to setup logging with ASM.

     

    If you are looking to view the ASM log manually, it usually logs out to '/var/log/asm' though not everything is logged here due to performance optimizations.

     

    Hope this helps.