I have currently a "funny" issue with an ASM Policy.
The policy is created and attached to a virtual server with the default HTTP Profile and the logging profile "log all requests". (LTM Policy for request forwarding to the ASM is also enabled)
The ASM policy uses the template "Fundamental" in automatic learning mode with the language "unicode UTF-8" and is in blocking mode - but the Enforcement Readiness Period is still running, so almost everything is in staging.
If i send a request to the VS, i can see the TS Cookie in the response, but no request is logged and of course no learning suggestions.
I already checked the /var/log/asm logs and the /var/log/ts logs. The only thing i could find is this line
F5::SetActive::Impl::invalidate_ramcache_cache,,Invalidate cache for policy
Whatever that means.
PS: All other Policies are working fine, requests are getting logged and learning suggestions as well.
Does anybody has an idea, what could be wrong?
Many thanks in advanced and with all my best regards
Are you in 15.1.3? I encountered a similar bug on it. Reloading config with mcpd resolved the problem: https://support.f5.com/csp/article/K13030
did that solve it for you?
Hi, yes i can confirm now, this solution was working for me. I am now able to see the event logs again from the ASM policy.
Looks like a bug, worth raising this with F5 Support.
There was a similar issue in the earlier versions of ASM as well, check out the solution if you landed here and you are on on v12.1-14.1