I am trying to generate some report using the Reporting feature available on ASM.
However, I have strange results for example :
Report for top 20 IP on a defined period (1st day to 1st day of the next month) I can see an IP with X hits
When i search on this IP on events logs (with same period), i have more logs than what is generated in the report.
Hits for an IP and no logs (illegal requests)
I am on BigIP 14.1.2.X
Have anyone already encounter this kind of behavior with the reporting capability of ASM ? Or are there any specification on the Reporting capabilities ?
ASM uses the AVR module to collect and report its statistical data. AVR aggregates logs by smaller segments - 1 day logs collected over 7 days get aggregated to a 1 week log, 1 week log over 4 weeks turns into 1 month aggregated, etc and it's this behavior that causes you to see a difference compared to the ASM request logs. The ASM requests logs do not aggregate.
