Forum Discussion

MSZ's avatar
MSZ
Icon for Nimbostratus rankNimbostratus
Aug 01, 2018

How to exempt any URL from event logs?

I would like to ask that is it possible to exempt a URL from event logs? For Example: https://www.mytest.com/test/list I have to exempt the URL "/test/list" from event logs (either alarm or blocked). I don't want to show any log from this URL. Already disabled all signatures from this URL. Allowed some HTTP method by over ridden. But still it is showing in event logs as "illegal http response: 405" (which is for HTTP method).

 

Current version: 13.0.0 HF2

 

ASM Advanced WAF
BIG-IP
security
  • lostpacket_5555's avatar
    lostpacket_5555
    Historic F5 Account
    Aug 03, 2018

    You can craft a custom iRule referencing a Data Group to disable ASM and/or DOSL7 processing based on URL string matching.

    iRule Definition:

    when HTTP_REQUEST {
if { [class match  [string tolower [HTTP::uri]] contains ]  } {
ASM::disable
DOSL7::disable
}
   return
}

    See https://support.f5.com/csp/article/K47781184