Forum Discussion
Bot Log is not showing in BIG-IQ
- Jun 04, 2023
Hi Emon_423837 ,
For Sending Security Logs yo BIG-IQ
1. Add BIG-IP to the BIG-IQ CM
2. Enable Web Application Security in BIG-IQ DCD
3. Configuration of the Security Log profile
4. Attach the log profile to the protected Virtual Servr
5. Monitoring Profiles from BIG-IQ
Can you please share the BOT Logging profile details.
Actually, the BIG-IQ DCD has a listening service in the 8514 port then we have to configure a log profile in the BIG-IP device to send events to the 8514 port.
Once it is configured, there will be security events in the BIG-IQ Central Management (CM) device, thus, we can already watch these logs for troubleshooting and applications visibility from BIG-IQ CM.
For more details could you plese check the link as follows:
Have you
Activate ASM Web Application Security events logging service for one or more BIG-IQ Data Collection Devices (DCD)
https://my.f5.com/manage/s/article/K51005651
Creating a DCD Pool
Define this pool in Log Destination
System >> Logs: Configuration : Log Destinations
System >> Logs: Configuration : Log Destinations
Now create one log destination for Splunk and here forward the destination to the previously created log destination
System >> Logs: Configuration : Log Destinations
Now check if you got 2 log destinations:
System >> Logs: Configuration : Log Destinations
Now create one log Publisher:
System >> Logs: Configuration :Log Publisher >> Log_pub_DCD
Can you check your logging profie and see if Bot protection is selected:
Select all the request log options of your choice
Save the logging profile
Attach/Assign this logging profile to the required Virtual Sever:
I am suspecting you may have missed this step, in case else check all the steps once again using the help of the screenshots I attached here:
After that hopefuy you can also see the logs in the Bot
Hi ,For Sending Security Logs yo BIG-IQ
1. Add BIG-IP to the BIG-IQ CM
2. Enable Web Application Security in BIG-IQ DCD
3. Configuration of the Security Log profile
4. Attach the log profile to the protected Virtual Servr
5. Monitoring Profiles from BIG-IQ
Can you please share the BOT Logging profile details.
Actually, the BIG-IQ DCD has a listening service in the 8514 port then we have to configure a log profile in the BIG-IP device to send events to the 8514 port.
Once it is configured, there will be security events in the BIG-IQ Central Management (CM) device, thus, we can already watch these logs for troubleshooting and applications visibility from BIG-IQ CM.
For more details could you plese check the link as follows:
Have you
Activate ASM Web Application Security events logging service for one or more BIG-IQ Data Collection Devices (DCD)
https://my.f5.com/manage/s/article/K51005651
Creating a DCD Pool , do not forget to metion the service port as 8514
Define this pool in Log Destination
System >> Logs: Configuration : Log Destinations
System >> Logs: Configuration : Log Destinations
Now create one log destination for Splunk and here forward the destination to the previously created log destination
System >> Logs: Configuration : Log Destinations
Now check if you got 2 log destinations:
System >> Logs: Configuration : Log Destinations
Now create one log Publisher:
System >> Logs: Configuration :Log Publisher >> Log_pub_DCD
Can you check your logging profie and see if Bot protection is selected:
Select all the request log options of your choice
Save the logging profile
Attach/Assign this logging profile to the required Virtual Sever:
I am suspecting you may have missed this step, in case else check all the steps once again using the help of the screenshots I attached here:
After that hopefuy you can also see the logs in the Bot
Click o any log to see its details:
Bot Traffic Dashboard
Bot Traffic By Class
Bot Traffic By Status
Bot Traffic By Mitigation
Bot Traffic Analytics
Layer 7 Security Dashboard
HTH
F5 Design Engineer
🙏
- Jun 06, 2023
Thanks for given me your valuable time.
One Correction:
- You must add Splunk type log destination on log publisher, Not High Speed Log Destination. When I add HSLD profile on log publisher. Log publisher was invisible on logging profile.
One more info: Our network desing was wrong. We want to reach out BIG-IP to DCD through management interface that was the problem. Because F5 Big-ip traffic not in or out through management port.
Before :
After:
Best Regards,Md. Emon Hossain
Hi Emon_423837 ,
Mixing control plane traffic and data plane traffic flwoing on same interfaces is not a good choice.
F5 strongly discourages you to configure a pool memeber or health monitor to send data plane traffic or probes using the management network because the management network is not intended for production traffic.
F5 recommends that the pool members/nodes reside on a network that is reachable through TMM interfaces so data plane trafic or health monitor probes are sent through TMM interfaces.
When configuring management traffic, you should consider the following factors:
- F5 strongly discourages you to configure a health monitor to send probes using the management network because the management network is not intended for production traffic. F5 recommends that the pool members/nodes reside on a network that is reachable through TMM interfaces so health monitor probes are sent through TMM interfaces.
- F5 recommends that you add static routes for management traffic whose destination does not match the directly-connected management network. This configuration is useful when you handle SNMP traffic that is directed to an SNMP Manager that resides on another network, which is accessible only through the management network or other network services that are hosted on networks that are not accessible through the TMM interfaces.
- A Virtual Clustered Multiprocessing (vCMP) host administrator can reconfigure the default management gateway for a vCMP guest. The applied configuration takes precedence and overrides the value configured on the vCMP guest.
Note: F5 recommends that you test any such changes during a maintenance window and consider the possible impact on your specific environment.
HTH
Best regards
F5 Design Engineer
Recent Discussions
Related Content
* Getting Started on DevCentral
* Community Guidelines
* Community Terms of Use / EULA
* Community Ranking Explained
* Community Resources
* Contact the DevCentral Team
* Update MFA on account.f5.com