Forum Discussion
NimbostratusF5 LTM logs and application access logs
Hi, I would like to ask for guidance, as I do not have the access to test on this kind of scenario. When using LTM to route the application traffic to the application server hosted in LTM virtual server. Meaning every time the requests from client will first reach the LTM before being forwarded/routed to the respective virtual server. (In case there isn't AWAF enabled)
In DFIR/SOC analyst's point of view, we would expect LTM logs would log the time slightly earlier for each requests than the access logs found in the server itself. However, if there were SQLi with payload containing "sleep", which would potentially delay the responses, how would these two different logs record the timestamp of the requests? Will the timestamps recorded in the access logs in the server itself would have delay if the payload is working?
1 Reply
- Daniel_Wolf
MVP
Hi enen ,
if there is a SQLi attack using the SLEEP command, it will pass LTM without affecting it. The SLEEP command will only affect the SQL server in the backend, where it is executed.
The packet first passes the load balancer, before it reaches the web server. However, the latency added by a load balancer is negligible, it is between milliseconds and microseconds.
Since webserver logs are usually in seconds and not milliseconds or microseconds, you won't notice it. Logs can easily be correlated.
It is important to know, that LTM in it's default configuration won't log the payload of a HTTP request. From the LTM log you cannot see the SQLi attack.If you want to protect yourself from SQLi and similar attacks - get a WAF :)
Cheers
Daniel
