cancel
Showing results for 
Search instead for 
Did you mean: 
Login & Join the DevCentral Connects Group to watch the Recorded LiveStream (May 12) on Basic iControl Security - show notes included.

ASM Chart Numbers Skewed From Event Logs

WAF_Monkey
Altostratus
Altostratus

Under Security >> Reporting:Application:Charts, when viewing by Request Types for the Time Period of "Last Month", I'm seeing vastly different numbers than what the event logs show for the same time period. For example, Blocked requests show 22 in the charts yet show 645,446 in the event logs. I see similar differences for Legal and Alarmed requests. I manage several F5's running ASM and this only occurs on two boxes that are running v14.1.0.6.

 

Has anyone seen this before? Any ideas why this is happening? It's screwing up my monthly metrics! 😞

2 REPLIES 2

Samir
Nacreous
Nacreous

What I observed, event log count is total raw number of blocked request. However in report 22 are categorised (types). Check the individual WAF policy which has more blocked request via reporting.

​If. Still have issue raise support case.

Thanks​

Ivan_Chernenkii
F5 Employee
F5 Employee

Data is aggregated into charts with some delay. Most probably if you will look at custom period or last week, then you will see more requests.

To get full data for last month you need to gather statistics for last 4 weeks.