Delete WAF log size after limitation

Good afternoon,

 

 

as far as I know, ASM generates 2 kinds of logs:

 

 

1. Audit logs: They are stored in /var/log/asm file and it behaves in the same way the others ltm / gtm logs.

 

 

2. Reporting logs: these "logs" include information about the requests done to your applications. You can get more information about how they are cleaned in https://support.f5.com/kb/en-us/solutions/public/6000/700/sol6714.html .

 

 

Kind regards,

 

Javier.

I have a little script that is suppose to dump & archieve off the PRX database.

 

 

problem is, how can I detect within my script whenever that rotation Limit value is reached prior to doing my dump. Sometimes these limit is reached within a few hours, sometimes in days, just depends, Any idea would be appreciated.

 

 

Cryptmod

Out of curiosity, what do you do with the archives? You could open a case with F5 Support and ask them to provide some type of archiving feature for ASM forensics.

 

 

We did something similar to what you're considering for a couple of customers on 9.3.x. We modified the /ts/tools/clean_db.pl script to call our custom violation export script before the clean_db script deleted any records. This isn't supported, but it was the best solution we came up with.

 

 

Aaron

thank you