Forum Discussion

muratalagoz's avatar
muratalagoz
Icon for Altostratus rankAltostratus
Jul 28, 2022

Export single ASM Event Log over API

Hello, I looked at the forum and also documentation but couldn't find anything.  I am trying to export single log Security ›› Event Logs : Application: Requests with the VT support id over API. (v ...
devops
security
  • muratalagoz's avatar
    muratalagoz
    Aug 01, 2022

    Hello,

    After days of debugging, I discovered that I am querying the support id as a List object.

    As a result, API does not return an error instead, the particular place is empty. After changing it to a string and everything works as expected. 

     

tatmotiv's avatar
tatmotiv
Icon for Cirrostratus rankCirrostratus

Can you provide some more insight on how you resolved this? I'm trying to do the same ("Export single ASM Event Log over API"), following this guide:  https://support.f5.com/csp/article/K50284219

I receive an html file which is useless, because it contains only a header with f5 logo and some metadata, but no details on the specific event ID at all. Although the html only displays very few lines, it is also about 800kb in size, but this seems to be due to the fact that it contains some java script that brings along a lot of static basic stuff like country codes, descriptions of violations and such. 

Is this the same error you enconuntered? If so, can you point out what you mean by "querying the support id as a List object" and "changing it to a string"? 

muratalagoz's avatar
muratalagoz
Icon for Altostratus rankAltostratus
Aug 02, 2022

I had the same issue. When you make the get request with the support id, when the support id is not correctly passed to the f5, it generates a report but a useless empty one.

In my case, because of my mistake:

Correct one:

What I can suggest is that you try to check your inputs. If you need more insight sharing the code:

    try:

        data = {
            "restPath": "/mgmt/tm/asm/events/requests",
            "filename": f"ASM_security_event_report_{datetime.now().strftime(DATE_FORMAT)}.html",
            "filter": f"id eq '{vt_number}'"
        }
        request = requests.post(url=f'{selected_f5}/mgmt/tm/asm/tasks/export-to-file', headers=headers, json=data, verify=False)
        filename = json.loads(request.text)['filename']
        id = json.loads(request.text)['id']
        request = requests.get(url=f'{selected_f5}/mgmt/tm/asm/tasks/export-to-file/{id}', headers=headers, verify=False)
        while json.loads(request.text)['status'] == "STARTED":
            request = requests.get(url=f'{selected_f5}/mgmt/tm/asm/tasks/export-to-file/{id}', headers=headers, verify=False)
            if json.loads(request.text)['status'] == 'COMPLETED':
                request = requests.delete(url=f'{selected_f5}/mgmt/tm/asm/tasks/export-to-file/{id}', headers=headers, verify=False)
        response = requests.get(url=f'{selected_f5}/mgmt/tm/asm/file-transfer/downloads/{filename}', headers=headers, verify=False)
        response.raise_for_status()
        with open('logs/%s' % filename, 'wb') as f:
            f.write(response.content)
        print(f'{filename} is saved to logs folder.')

I didn't use the article that you shared. I intercept every request with UI and replicate the steps in python. 

I hope it helps your case.