cancel
Showing results for 
Search instead for 
Did you mean: 

ASM Reporting feature

jkieffer
Nimbostratus
Nimbostratus

Hello,

 

I am trying to generate some report using the Reporting feature available on ASM.

However, I have strange results for example :

  • Report for top 20 IP on a defined period (1st day to 1st day of the next month) I can see an IP with X hits
  • When i search on this IP on events logs (with same period), i have more logs than what is generated in the report.

 

  • Hits for an IP and no logs (illegal requests)

 

I am on BigIP 14.1.2.X

Have anyone already encounter this kind of behavior with the reporting capability of ASM ? Or are there any specification on the Reporting capabilities ?

 

Best Regards.

1 REPLY 1

Andrew-F5
F5 Employee
F5 Employee

ASM uses the AVR module to collect and report its statistical data. AVR aggregates logs by smaller segments - 1 day logs collected over 7 days get aggregated to a 1 week log, 1 week log over 4 weeks turns into 1 month aggregated, etc and it's this behavior that causes you to see a difference compared to the ASM request logs. The ASM requests logs do not aggregate.