Forum Discussion

JustCooLpOOLe's avatar
JustCooLpOOLe
Icon for Cirrocumulus rankCirrocumulus
May 22, 2017

Logging Profiles and ASM

Some background information on our environment, we are running a pair of 5000s (C109) in an active/standby configuration with LTM and ASM (version 12.0 Build 3.0.654). As we are getting more into ASM (currently one application but more are coming), I configure my logging profiles for local logging (uncheck guarantee local logging) and remote logging (configured for Splunk). Splunk is controlled by our InfoSec team but it is not set up and they are working with consultants to stand it up at the moment. I just sent the logs over there in preparation.

 

I'm looking for any suggestions on best practice around logging profiles. I'd like to still run the reports from ASM and well as look at any illegal requests that show up in Event Logs -> Application -> Request to view the illegal requests. I also don't want to find out I've filled up the disk at some point. Will the logs just roll over at that point?

 

application delivery
ASM Advanced WAF
BIG-IP
security
  • CharlesCS's avatar
    CharlesCS
    Icon for Cirrus rankCirrus
    May 22, 2017

    Data in the ASM Event Log is stored in MySQL tables having a fixed maximum size -- both in the number of rows available as well as the total space used -- so when the event log gets full, the oldest data is purged.