Forum Discussion

saidshow_251381's avatar
saidshow_251381
Icon for Cirrostratus rankCirrostratus
Oct 19, 2016

Is it possible to set multiple IPs in the Source IP Address of the advanced ASM Event log search?

Hi,

 

I want to exclude a couple IPs from the event logs I am looking at. I can set the drop down to 'is not' for the Source IP field and enter one IP address, removing this one IP from the event logs I am searching. Is there an operator or something similar that I can use to separate multiple IPs to remove more than one IP from the event logs? Thank You.

 

Kind Regards Chris

 

ASM Advanced WAF
event logs
ips
log
logs
multiple
security
  • Jinshu's avatar
    Jinshu
    Icon for Cirrus rankCirrus
    Oct 19, 2016

    Unfortunatly the answer is 'No'. You cant input multiple IP address to extract the event logs from ASM console.

     

    You can try extract the logs from big ip cli, /var/log/asm file and filter it with grep commands( and/or functions).

     

    -Jinshu

     

  • Tikka_Nagi_1315's avatar
    Tikka_Nagi_1315
    Historic F5 Account
    Oct 19, 2016

    I don't believe you can specify multiple ip addresses. You can filter with route domain on the source ip field as ip_address%route_domain_id.