Forum Discussion

Dominik_M's avatar
Dominik_M
Icon for Altostratus rankAltostratus
Jul 14, 2021

No event logs for an ASM Policy

Hello,

 

I have currently a "funny" issue with an ASM Policy.

The policy is created and attached to a virtual server with the default HTTP Profile and the logging profile "log all requests". (LTM Policy for request forwarding to the ASM is also enabled)

The ASM policy uses the template "Fundamental" in automatic learning mode with the language "unicode UTF-8" and is in blocking mode - but the Enforcement Readiness Period is still running, so almost everything is in staging.

 

If i send a request to the VS, i can see the TS Cookie in the response, but no request is logged and of course no learning suggestions.

I already checked the /var/log/asm logs and the /var/log/ts logs. The only thing i could find is this line

 

F5::SetActive::Impl::invalidate_ramcache_cache,,Invalidate cache for policy

 

Whatever that means.

PS: All other Policies are working fine, requests are getting logged and learning suggestions as well.

 

Does anybody has an idea, what could be wrong?

 

Many thanks in advanced and with all my best regards

Dominik

 

 

ASM Advanced WAF
BIG-IP
security
  • Amine_Kadimi's avatar
    Amine_Kadimi
    Icon for MVP rankMVP
    Jul 15, 2021

    Are you in 15.1.3? I encountered a similar bug on it. Reloading config with mcpd resolved the problem: https://support.f5.com/csp/article/K13030

     

  • Dominik_M's avatar
    Dominik_M
    Icon for Altostratus rankAltostratus
    Jul 16, 2021

    Thanks for your answer. Currently we are in 15.1.2.

    I will test your solution ASAP and let you know the outcome.

      • Dominik_M's avatar
        Dominik_M
        Icon for Altostratus rankAltostratus
        Jul 30, 2021

        Hi, yes i can confirm now, this solution was working for me. I am now able to see the event logs again from the ASM policy.

  • Dominik_M's avatar
    Dominik_M
    Icon for Altostratus rankAltostratus
    Jul 26, 2021

    i am not able to check it yet, because currently the second device is online. As soon as the first device is online again, we can check. Hopefully this week.

  • samstep's avatar
    samstep
    Icon for Cirrocumulus rankCirrocumulus
    Jul 28, 2021

    Looks like a bug, worth raising this with F5 Support.

     

    There was a similar issue in the earlier versions of ASM as well, check out the solution if you landed here and you are on on v12.1-14.1

     

    https://support.f5.com/csp/article/K93091504