Is there a way to export BigIP Analytics http captured transactions?
Are there any commands to export the http captured transactions? When trying to troubleshoot TLS 1.3 encrypted traffic we can set up an Analytics profile with the specific traffic we want to capture. It works and we can see the captured transactions manually, one by one, through the web interface. Is there a way to export all those captured transactions so we can share them offline?
Enabling AVR and creating Profiles
Hi All, I've recently provisioned the AVR module (nominal) with out too much trouble. However when I attempt to create a HTTP Analytics profile, I don't see all the my Virtual Servers. I don't see any Virtual Servers when I look at the Statistics->Analytics->HTTP. However I am able to access: Statistics->Analytics->Virtual Servers- Statistics->Analytics->Pools Not sure what I'm missing, that I'm unable to see all the relevant info. Appreciate all advice and suggestions. Thanks Deena
Applying Analytics profile to VS changes chunking behavior?
Hi, I was doing some test (v11.2.0HF7) and for some reason two almost identically configured server was delivering different responses to the client: One chunked Second not chunked Both VS were sending traffic to the same backend server, using same settings for Response Chunking: Selective After long trial&error it turned out that disconnecting Analytics profile from VS disables chunking of the reply send to client. Why so? Is that bug or expected behavior? In Analytics profile options enabled as below: ltm profile analytics my-analytics { alerts none app-service none captured-traffic-external-logging disabled captured-traffic-internal-logging enabled collect-geo disabled collect-http-throughput enabled collect-ip disabled collect-methods enabled collect-page-load-time enabled collect-response-codes enabled collect-server-latency enabled collect-url enabled collect-user-agent disabled collect-user-sessions disabled collected-stats-external-logging disabled collected-stats-internal-logging enabled defaults-from analytics description none notification-by-email disabled notification-by-snmp disabled notification-by-syslog disabled notification-email-addresses none partition Common remote-server-ip any6 remote-server-port 514 remote-server-syslog-facility local0 sampling-ratio 1 session-timeout-minutes 30 smtp-config none traffic-capture { capturing-for-my-analytics { app-service none captured-protocols all client-ips none methods none node-addresses none request-captured-parts headers request-content-filter-search-part none request-content-filter-search-string none response-captured-parts headers response-codes none response-content-filter-search-part none response-content-filter-search-string none url-path-prefixes none user-agent-substrings none virtual-servers none } } trust-xff enabled } Is any of above setting forcing VS to send chunked response to client? PiotrApplying Analytics profile to VS changes chunking behavior?
Hi, I was doing some test (v11.2.0HF7) and for some reason two almost identically configured server was delivering different responses to the client: One chunked Second not chunked Both VS were sending traffic to the same backend server, using same settings for Response Chunking: Selective After long trial&error it turned out that disconnecting Analytics profile from VS disables chunking of the reply send to client. Why so? Is that bug or expected behavior? In Analytics profile options enabled as below: ltm profile analytics my-analytics { alerts none app-service none captured-traffic-external-logging disabled captured-traffic-internal-logging enabled collect-geo disabled collect-http-throughput enabled collect-ip disabled collect-methods enabled collect-page-load-time enabled collect-response-codes enabled collect-server-latency enabled collect-url enabled collect-user-agent disabled collect-user-sessions disabled collected-stats-external-logging disabled collected-stats-internal-logging enabled defaults-from analytics description none notification-by-email disabled notification-by-snmp disabled notification-by-syslog disabled notification-email-addresses none partition Common remote-server-ip any6 remote-server-port 514 remote-server-syslog-facility local0 sampling-ratio 1 session-timeout-minutes 30 smtp-config none traffic-capture { capturing-for-my-analytics { app-service none captured-protocols all client-ips none methods none node-addresses none request-captured-parts headers request-content-filter-search-part none request-content-filter-search-string none response-captured-parts headers response-codes none response-content-filter-search-part none response-content-filter-search-string none url-path-prefixes none user-agent-substrings none virtual-servers none } } trust-xff enabled } Is any of above setting forcing VS to send chunked response to client? PiotrHow to generate ASM report from a pre-defined filter using TMSH
Is there a way to generate a report using a pre-defined report (filter) using CLI (TMSH)? Though I should be able to generate the same report by typing down the filter for the report in TMSH but TMSH does not understand the Drilldown for Security Policy for some reason. For instanace, when I try to run the following command it is not able to identify the Policy save analytics application-security report view-by attack-type measures { occurrences } drilldown {{ entity policy values { My_Security_Policy_Name } } } format pdf file foo.pdf range now-3w The error I get for above is : Data Input Error: Invalid entity value My_Security_Policy_Name This is strange because I am able to see and set Security Policies in the filter in GUI. I am using Big-IP 12.1.0.AVR: User-Agent Strings
I'm looking at the AVR metrics collected, and trying to figure out which user-agents are most common in our environment. When I look at the analytics page, I can see the top 10 user-agents, but I can't seem to get anywhere to copy the full user-agent string (so i can parse out the specifics). It always truncates it somehow, even when I export the PDF or CSV. I did find here that I can view the data I'm looking for through tmsh with something like show / analytics http report view-by user-agent range now-31d , but I'd like to find a way to grab it from the GUI instead if I could. Any thoughts or experience with this?F5 analytics iApp on v14.1
Hi everybody. I'm doing some testing with v14.1, and I've tried to install the F5 Analytics iApp. I've installed the f5.analytics.v3.7.2rc4 template and configured it with default values more or less. The iApp deploys without any problems, but is logging an error message when trying to run the iCall script: hostname="bigip1.home.local",errdefs_msgno="014f0013:3:",msg="Script (/Common/analytics-send_stats1) generated this Tcl error: (script did not successfully complete: (can't read \"splunkdestinationip_withrd\": no such variable\n while executing\n\"string compare \"$splunkdestinationip_withrd\" \"0\" \"\n (\"Splunk\" arm line 5)\n invoked from within\n\"switch -- $format {\n \"Splunk\" -\n \"F5 Analytics\" {\n catch {exec /bin/gzip $filename$i$ext -f}\n ...\"\n (\"for\" body line 4)\n invoked from within\n\"for {set i 0} {$i <= $currentfile} {incr i} {\n set curl_response \"fail\"\n set ext \"\"\n switch -- $format {\n ...\" line:2619))" I don't have any route domains or partition configured on my BigIP. Any ideas?
Why does "Page Load Time" in AVR show no sampled transactions?
Hi All, I've got AVR working fine other than this so far. It's not clear to me if Page Load Times, currently showing N/A to transactions, needs more in the analytics profile than just Statistics Logging Type enabling (set to internal at the moment). I've tried several options, I got it to work... Once... But pretty much all options were on. I don't actually want all options. Current settings I have: ltm profile analytics analytics { app-service none captured-traffic-external-logging disabled captured-traffic-internal-logging disabled collect-geo disabled collect-ip disabled collect-max-tps-and-throughput enabled collect-methods enabled collect-page-load-time enabled collect-response-codes enabled collect-subnets disabled collect-url disabled collect-user-agent disabled collect-user-sessions enabled collected-stats-external-logging disabled collected-stats-internal-logging enabled description none notification-by-email disabled notification-by-snmp disabled notification-by-syslog disabled partition Common publish-irule-statistics disabled sampling disabled session-cookie-security ssl-only session-timeout-minutes 5 smtp-config none traffic-capture { capturing-for-analytics { request-captured-parts headers response-captured-parts headers } } } The profile is attached to the appropriate virtual-server. Any and all input is much appreciated. JDAnalytics: How to Expand the "Details" table to get more entries listed?
Version: 11.6.3 Navigation path: Statistics ›› Analytics : HTTP : Transactions The "Details" table lists only 10 items and then an "Overall" entry. The "Total Entries" would run into hundreds. How do I get more than ten entries listed?