Forum Discussion

jkieffer's avatar
jkieffer
Icon for Nimbostratus rankNimbostratus
Nov 02, 2020

ASM Reporting feature

Hello,

 

I am trying to generate some report using the Reporting feature available on ASM.

However, I have strange results for example :

  • Report for top 20 IP on a defined period (1st day to 1st day of the next month) I can see an IP with X hits
  • When i search on this IP on events logs (with same period), i have more logs than what is generated in the report.

 

  • Hits for an IP and no logs (illegal requests)

 

I am on BigIP 14.1.2.X

Have anyone already encounter this kind of behavior with the reporting capability of ASM ? Or are there any specification on the Reporting capabilities ?

 

Best Regards.

ASM Advanced WAF
security
  • Andrew-F5's avatar
    Andrew-F5
    Icon for Employee rankEmployee
    Nov 03, 2020

    ASM uses the AVR module to collect and report its statistical data. AVR aggregates logs by smaller segments - 1 day logs collected over 7 days get aggregated to a 1 week log, 1 week log over 4 weeks turns into 1 month aggregated, etc and it's this behavior that causes you to see a difference compared to the ASM request logs. The ASM requests logs do not aggregate.