For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

jkieffer's avatar
jkieffer
Icon for Nimbostratus rankNimbostratus
Nov 02, 2020

ASM Reporting feature

Hello,

 

I am trying to generate some report using the Reporting feature available on ASM.

However, I have strange results for example :

  • Report for top 20 IP on a defined period (1st day to 1st day of the next month) I can see an IP with X hits
  • When i search on this IP on events logs (with same period), i have more logs than what is generated in the report.

 

  • Hits for an IP and no logs (illegal requests)

 

I am on BigIP 14.1.2.X

Have anyone already encounter this kind of behavior with the reporting capability of ASM ? Or are there any specification on the Reporting capabilities ?

 

Best Regards.

ASM Advanced WAF
security

1 Reply

  • Andrew-F5's avatar
    Andrew-F5
    Icon for Employee rankEmployee
    Nov 03, 2020

    ASM uses the AVR module to collect and report its statistical data. AVR aggregates logs by smaller segments - 1 day logs collected over 7 days get aggregated to a 1 week log, 1 week log over 4 weeks turns into 1 month aggregated, etc and it's this behavior that causes you to see a difference compared to the ASM request logs. The ASM requests logs do not aggregate.