F5 LTM logs and application access logs

Hi enen​ ,

if there is a SQLi attack using the SLEEP command, it will pass LTM without affecting it. The SLEEP command will only affect the SQL server in the backend, where it is executed.
The packet first passes the load balancer, before it reaches the web server. However, the latency added by a load balancer is negligible, it is between milliseconds and microseconds.
Since webserver logs are usually in seconds and not milliseconds or microseconds, you won't notice it. Logs can easily be correlated.
It is important to know, that LTM in it's default configuration won't log the payload of a HTTP request. From the LTM log you cannot see the SQLi attack.

If you want to protect yourself from SQLi and similar attacks - get a WAF :)

Cheers
Daniel