Forum Discussion
NimbostratusASM Request - Event Correlation Differencies
Request Log can get cycled through if you are having a high rate of traffic, or it's been a long time since the correlation event was logged, or the related events might have been cleared (deleted) manually. Local logging is also not guaranteed by default and could fall through if the system is otherwise busy, but this rarely happens unless on very busy boxes.
By default, at about 2GB of disk usage, older events will start to be deleted, and also at 3 million records, whichever one is reached first. These limits can take ages on a device in the lab, but easily take half a day on a busy production site. Local logging is meant for quick troubleshooting only and for anything more extensive, you should have off-box logging (many logging destinations are supported).
It might help to go through the manual as well: https://support.f5.com/kb/en-us/products/big-ip_asm/manuals/product/asm-config-11-2-0/asm_monitoring.html?sr=528965261055514
MEminThanks FKnuckles. I want to get strict my dos profile but concern about false/positives. Do you have any suggestions for the connections as shown the below? Open Connections: 170-200 Tp: 2-3 mbps Rate Limitings are at default values. ie: TPS increased by: 500% and reached at least 40 transactions per second OR TPS reached: 200 Thanks for your support- open connections is not necessarily related. Look for information about average HTTP request per second and base your thresholds on that. Note the distinction between "Site-wide" and "Per-IP" and "Per-URL". Per-IP should be low, in my view, for anything that is not a Proxy (you might want to look into X-forwarded-for), you really shouldn't expect more than 2 requests per second from that IP on average. If it's a proxy, and you can trust it's X-FF header, then you can configure a low threshold per-IP. Per-URL is an aggregation of all IPs accessing that URL, and so you want to see how many users on average make requests to busiest URL at peak, and make your per-URL threshold is around that value. Site-wide is an aggregate of all traffic being handled by that policy and you want to set a treshold that allows legitimate traffic through. The "TPS Reached" is an absolute hard-line above which the system treats it as an attack, and starts applying mitigation. If you know that your site should never have more than 200 requests per second, then yes, set that value to 200, otherwise, adjust it to fit your needs.
Jad_Tabbara__J1Cirrostratus
Hello BinaryCanary,
Is it possible to change/reduce these values ? If yes how because I didn't find any doc. about it (ASM v12.1.2)
For example, to pass the ASM log DB size from 2GB to 1GB and the 3 Million to 1.5 Million ?
Thanks
