AFM reporting no data
Hi! I have an AFM installation here that seems to be working very well as firewall and ddos protection, but the problem is that none of the reports are working. I have a logging profile created for all the VSs and the publisher is set as local-db-publisher everywhere. Logs working: Reports not working: It is also possible to observe some javascript errors being report in console: My logging profile: security log profile Log_Local { dos-network-publisher local-db-publisher ip-intelligence { log-publisher local-db-publisher } network { Log_Local { filter { log-ip-errors enabled log-tcp-errors enabled } publisher local-db-publisher } } port-misuse { log-publisher local-db-publisher } protocol-dns-dos-publisher local-db-publisher protocol-inspection { log-publisher local-db-publisher } protocol-sip-dos-publisher local-db-publisher traffic-statistics { active-flows enabled log-publisher local-db-publisher missed-flows enabled reaped-flows enabled syncookies enabled syncookies-whitelist enabled } } Am I doing something wrong? Thanks!iControl - Run and fetch APM Reports
Hi, Is it possible to run and download APM reports via iControl? Either JSON or CSV would be fine. I've had a play around with the /mgmt/tm/apm/report/ endpoint, however this seems to only give some basic properties of the report as opposed to actually generating and fetching a report. I've also looked around DevCentral but haven't found any discussions on this. If not iControl, is another method available? I did see this thread (https://devcentral.f5.com/questions/apm-reporting-by-tmsh) regarding TMSH. An RFE was mentioned, however it was apparently still open as of 2015. (ID 413709 - Need command-line based reporting capabilities with CSV results (or scheduling of reports). I've already played around with TMSH and couldn't find anything useful. Thanks, Andrew
APM logs (BIGIP 13.0.0)
Hi all One of my APM users was denied by the access policy. Trying to troubleshoot the problem, i tried to search the session id in the reports. But only last day is shown (even when i try to show "all sessions"). How could i extend the reported days? And (this i suppose has nothing to do with the reports, but not sure), i dont kwnow how to change the /var/log/apm files rotation (only 4 days stored). Thanks for your help!
Scheduled Report - Top Attacks By Security Policy
Hello, I am looking to generate a scheduled report to display the top attacks by each security policy I have (4) and I am using v12.1.2. I navigate to "Security ›› Reporting : Scheduled Reports" and enter the required fields such as name, SMTP info, frequency, etc. But the question is obviously in the exact configuration of the report. If I use... Dynamic Report Time Period: Last Week Show Results: Top 20 Top Report Criteria: Security Policy Select Measure: Requests .. then I get a report with a chart that shows the amount of requests each of those policies has received. Cool. But that is not exactly what I want. So I hit the plus button to "Use top result from security policy to report" > "Attack Type" Is there any way that I can "Use ALL results from security policy to report > Attack Type" ?? Any other info on how I could get something like this working to see attack types / violation for the last week from all my policies is appreciated. It is hard to share this info with others when I can only see traffic from my largest virtual server in these reports.
APM logs (BIGIP 13.0.0)
Hi all One of my APM users was denied by the access policy. Trying to troubleshoot the problem, i tried to search the session id in the reports. But only last day is shown (even when i try to show "all sessions"). How could i extend the reported days? And (this i suppose has nothing to do with the reports, but not sure), i dont kwnow how to change the /var/log/apm files rotation (only 4 days stored). Thanks for your help!
Retrieve Historical APM Log Data
Hi guys, A simple one for you (hopefully!). Is there anyway to retrieve historical APM data from the platform? By default it only seems to be capturing around 30 days worth of transactions. We're trying to populate a list of individual users who have successfully authenticated in the past 3 months. Thanks Peter
EM4000 - Reports are not sent by e-mail
I configured an EM4000 so I'm receiving alerts via e-mail but I don't receive reports via e-mail I did this steps to configure the SMTP Service: I configured the SMTP profile in System/Configuration/Device/SMTP submenu, then I selected it in Enterprise Manager/Options/Servers/SMTP Server option. I made a test creating a report. I added 3 e-mails accounts in the report configuration but I didn't receive the e-mails with the report. Can you help me to understand why I am not receiving reports?
