F5 AWAF Log Troubleshooting

The ASM event log is a MySQL database that is created when ASM is first provisioned on a BIG-IP system. As such, its size and capacity are fixed.

F5 article: Logging-application-security-events

F5 Suggests:

• Local storage with illegal requests

• Remote storage of all requests (Remote filter in Splunk format (user-defined format with Splunk field names).)

_{***F5 recommends to log only illegal requests locally for Virtual Servers where ASM policy is not in learning mode. Remote logging is preferred choice for Logging all requests. This will drastically reduce the number of requests being logged allowing them to stay longer on the unit.}

F5 article: K53178761

df -h /var/asmdata1

tailf /var/log/ts/asmlogd.log

/var/asmdata1/request_log is the location where all the request logs info get stored
It has a size limit of 2GB or 3 million records (whichever one comes first) and when this is filled up, the clean_db process cleans up the request logs by dropping the older partitions to make room for new incoming entries that are being logged locally (if the virtual servers have a logging profile to log requests locally). This prevents /var/asmdata1 from becoming full or being oversubscribed beyond its limit.

The directory /var/asmdata1/request_log is what is limited to 3 GB or 3 Million records. Whichever limit is reached first, process clean_db cleans up the request logs by dropping the older partitions to make room for new incoming entries that are being logged locally (if the virtual servers have a logging profile to log requests locally). This prevents /var/asmdata1/request_log from becoming full or being oversubscribed beyond its limit.
To Check which of the limits have reached, refer to the following:

Row limit; the following command shows the number of requests that exist within MySQL database:

mysql -uasm -pperl -MF5::Cfg -e 'print F5::Cfg::get_mysql_password()' -e “select COUNT(*) from PRX.REQUEST_LOG”

Disk space:

cd /var/asmdata1/request_log/

du -ach

Confirm clean_db process is dropping older partitions by running
grep “delete_unused_protobuf” /var/log/ts/asmlogd.log

[https://eventguyz.com/wp-content/uploads/2024/05/hosang-i-t-python-02.png@usfnt1slbdz01:Active:In Sync] log # zgrep “May” asm.[1-9].gz