Forum Discussion

kaoutar's avatar
kaoutar
Icon for Cirrus rankCirrus
Jun 11, 2019

logging issues ASM 13.1.1.4

Hi all, would like to ask about logging issue in ASM version 13.1.1.4. when a new policy is created no request is logged but the learning process is running which means that the builder policy lear...
ASM Advanced WAF
BIG-IP
security
Andrew-F5's avatar
Andrew-F5
Icon for Employee rankEmployee

"when a new policy is created no request is logged but the learning process is running which means that the builder policy learn from the traffic but it doesn't display any request at the event log."

  • Did you apply a logging profile to the virtual server that has this new ASM policy? Are you filtering for legal and illegal requests? (remove the illegal log filter)

 

"another issue is faced with the logging profile, when a change is made with an existed VS it will not be taken under consideration, for example when a logging profile set disabled for a VS, it still log the requests sent to that VS."

  • How are you disabling the logging profile? Removing ti from the virtual server? Are you saying that after removing the logging profile from a virtual server you are still seeing new ASM logs for that policy for that specific virtual server?

 

"ASM subsystem error (asm_start,F5::NwdUtils::Nwd::log_failure): Watchdog detected failure for process. Process name: pabnagd, Failure: Insufficient number of threads (required: 2, found: 0).  "

 

Best,

Andrew

 

kaoutar's avatar
kaoutar
Icon for Cirrus rankCirrus
Jun 14, 2019

first i wanna thank you for the attention you paid to my request.

"Did you apply a logging profile to the virtual server that has this new ASM policy? Are you filtering for legal and illegal requests? (remove the illegal log filter)"

  • Yes i did apply a logging profile to that VS with a filter of legal and illegal requests, nevertheless no request was logged even if i modified the applied filter.

"How are you disabling the logging profile? Removing ti from the virtual server? Are you saying that after removing the logging profile from a virtual server you are still seeing new ASM logs for that policy for that specific virtual server?"

  • I disabled the logging profile by removing it from the VS and still no request logged.

i didn't mention in my last post that when i activate the host name learning option at the building setting, the relative log shows but with a message indicates that this log is for learning only.