Under Security >> Reporting:Application:Charts, when viewing by Request Types for the Time Period of "Last Month", I'm seeing vastly different numbers than what the event logs show for the same time period. For example, Blocked requests show 22 in the charts yet show 645,446 in the event logs. I see similar differences for Legal and Alarmed requests. I manage several F5's running ASM and this only occurs on two boxes that are running v184.108.40.206.
Has anyone seen this before? Any ideas why this is happening? It's screwing up my monthly metrics! 😞
What I observed, event log count is total raw number of blocked request. However in report 22 are categorised (types). Check the individual WAF policy which has more blocked request via reporting.
If. Still have issue raise support case.
Data is aggregated into charts with some delay. Most probably if you will look at custom period or last week, then you will see more requests.
To get full data for last month you need to gather statistics for last 4 weeks.