For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

nolipineda's avatar
nolipineda
Icon for Altostratus rankAltostratus
Oct 28, 2015

viewing full request on ASM Reporting

Hi,

 

Is there a way to get the full request on ASM Reporting?

 

SOL12044 says default behavior is ASM truncates the request on ASM Reporting.

 

https://support.f5.com/kb/en-us/solutions/public/12000/000/sol12044.html

 

Reason I asked is I am seeing traffic that matches Cross Site Scripting signature but it is not showing the violation details (eg. matching string, etc).

 

Thanks in advance for the assistance.

 

ASM Advanced WAF
security
xss

3 Replies

  • Dan_Markhasin_1's avatar
    Dan_Markhasin_1
    Icon for Nimbostratus rankNimbostratus
    Oct 28, 2015

    You need to configure a logging profile in ASM to log the response as well as the request, and then assign that profile to the Virtual Server (via Security -> Policies).

     

    • nolipineda's avatar
      nolipineda
      Icon for Altostratus rankAltostratus
      Oct 28, 2015
      Thanks Dan but I am after the full request and not HTTP response. I do have an ASM logging profile that sends the log to Splunk but even that remote log is showing as truncated.
    • Dan_Markhasin_1's avatar
      Dan_Markhasin_1
      Icon for Nimbostratus rankNimbostratus
      Oct 28, 2015
      Sorry, I misread your question. Have you tried using an iRule to capture the request and see if it also gets truncated there?