F5 LTM logs and application access logs
Hi, I would like to ask for guidance, as I do not have the access to test on this kind of scenario. When using LTM to route the application traffic to the application server hosted in LTM virtual server. Meaning every time the requests from client will first reach the LTM before being forwarded/routed to the respective virtual server. (In case there isn't AWAF enabled) In DFIR/SOC analyst's point of view, we would expect LTM logs would log the time slightly earlier for each requests than the access logs found in the server itself. However, if there were SQLi with payload containing "sleep", which would potentially delay the responses, how would these two different logs record the timestamp of the requests? Will the timestamps recorded in the access logs in the server itself would have delay if the payload is working?