Forum Discussion

brain_damaged's avatar
brain_damaged
Icon for Nimbostratus rankNimbostratus
Dec 05, 2024

Most Blocked Log Events could not be found

Hi All, 

I am using WAF F5 and the WAF is intermittently blocking the HTTP requests, as The WAF is running at Blocking Mode. 

(It is returning the HTML page generated by WAF with Support ID given)   

I checked the Event Logs->Application->Requests 

I can find Legal Requests, Unblocked Requests from the list 

I can also find some Blocked Requests triggered by HTTP code 405 which was returned from my application server. 

 

But I cannot find other Blocked Requests from the list, either by full search/URL search and support ID search. 

I also tried to click the Operation IDs -> Blocked Requests. (There are 441K requests ), but the list is showing nothing. 

 

Is it the settings problem ? Can I find those logs in file system  ? e.g. /var/log/xxxx ? 

 

Thank you 

security
  • Mohamed_Salah_'s avatar
    Mohamed_Salah_
    Icon for MVP rankMVP
    Dec 11, 2024

    sometimes if there are multiple virtual server having "Log all requests" assigned, you might be missing the other logs like "blocked ones" because F5 now is actually logging each and every single request coming to those virtual server.

    If this is the case, consider removing these profiles, and add "log illegal requests only" and if the issue still persists, try killing logging process, by running the below commands and test again:

    pkill -f pabnagd

    pkill -f asmlogd

    pkill -f asm_config_server