For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

dwbrown_260122's avatar
dwbrown_260122
Icon for Nimbostratus rankNimbostratus
Dec 15, 2016

Device Version missing from logs

I am sending logs to McAfee ESM and after a system restore and fail-over the ASM is no longer sending the device version in the logs. This is a required field for McAfee. Prior to the crash this field was included in the logs being sent. Without this field it causes the ESM to be unable to parse the data correctly. Has anyone ever seen this?

 

Example from log: the || is were the device version should be. Dec 14 14:34:12 TR01PPAF5003.mgmt.shoremortgage.com ASM:CEF:0|F5|ASM||Illegal meta character in parameter name|Illegal meta character in parameter name|5|

 

Thanks for the help.

 

ASM Advanced WAF
security

1 Reply

  • Chris_Grant's avatar
    Chris_Grant
    Icon for Employee rankEmployee
    Dec 21, 2016

    If this was working and broke after a crash, but without any further changes, then I would open a support ticket. There is a known issue in certain versions of 11.5.0, 11.5.1, and 11.6.0 where we fail to send logs, but this should have been the case before the crash (ID493234). This should be fixed in the latest hotfixes.