Forum Discussion

Stefan_Klotz_85's avatar
Mar 10, 2016

ASM traffic learning limitations

I would be very interested in more transparency in regards of the traffic learning process and especially the limitations of the internal table/database, where learning suggestions are stored. We found out last year (we opened a ticket with F5 support) that there seems to be limit on how many entries can be stored. Here is the official statement from the operator:

The learning request table has a maximum of 100,000 records.
Other tables that contain learning data for various violation types have a typical maximum of 5000 entries (with some exceptions).

The issue we had and what I also can confirm right now (in a different environment) is, that entries in the Manual Traffic Learning section might disappear. It looks like this will be handled via FIFO, but there aren't any details on that. Additionally the operator mentioned, that there is no tmsh-command to check these tables. It only seems to be possible via the ASMqkview.

Are there any official documents/manuals available or can someone shade some light on this?

Thank you!

Ciao Stefan 🙂

1 Reply

  • There aren't any manuals or formal documents on this, no. And yes, it's a First In First Out model. In extreme cases this can happen very quickly (worst I've seen was 45 minutes worth of retained logs). The best approach is to review them regularly to prevent them from filling up your logs.

     

    And you are correct, there is no tmsh command to review the size of the tables.