NimbostratusIf we have an ASM policy applied on a virtualserver in transparent mode, no request is treated as "Illegal request". Hence we can't see what is blocked.
We want to know what WOULD be blocked if the policy was in blocking mode.
How can we configure the log profile to log "illegal" requests but not "All requests".
Version 12
CirrusHi,
in transparant mode you can still see the "illegal request".
Check your violation rating in event logs application requests.
EmployeeOOTB functionality is illustrated in the screenshot above. If you selected Log illegal requests and assigned it to the virtual server it should work. It sounds like maybe you have created a custom logging profile, which is fine. If you have a custom profile you need to assign it to the virtual server in the same way. Can you try sending a request you know is illegal, perhaps by triggering a simple attack signature? If you go to the Learning and Blocking Settings page, do any of the violations, especially attack signature violations, have the "Alarm" check box selected?