Back to List

Answers

Changing the default ASM DB log size and the default number of entries

Updated 20-Jul-2017•Originally posted on 20-Jul-2017 by Jad Tabbara (JTI) 2361

asm security

Hello,

Is it possible to change/reduce the default ASM DB log size and the default number of entries.

We are running BIG-IP 12.1.2 and I found on devcentral two answers from F5 saying that default values are

2 GB for the DB size or 3 million entries (depending on which one is reached first)

https://devcentral.f5.com/questions/asm-request-event-correlation-differencies

https://devcentral.f5.com/questions/asm-logging

Thanks

Answers to this Question

USER ACCEPTED ANSWER & F5 ACCEPTED ANSWER

Updated 20-Jul-2017•Originally posted on 20-Jul-2017 by CharlesCS 630

The ASM event log is a MySQL database that is created when ASM is first provisioned on a BIG-IP system. As such, its size and capacity are fixed.

USER ACCEPTED ANSWER & F5 ACCEPTED ANSWER

Updated 20-Jul-2017•Originally posted on 20-Jul-2017 by samstep 1854

Why would you want to reduce it? it is not a 'default' size but a maximum one and its limits are defined by the fact that it is stored in mySQL database built-into ASM. I think you might be confusing it with asm.log file on the file system

USER ACCEPTED ANSWER & F5 ACCEPTED ANSWER

Updated 21-Jul-2017•Originally posted on 21-Jul-2017 by Ashwin Venkat F5

JT,

While it is possible to increase the amount of requests that can be stored in the mysql db (either the number of requests or the size of the db itself), it's not something that we'd recommend as it can cause performance impact (particularly with the GUI in loading all the requests). If you see more requests being logged than the specified limit, then we'd recommend going with using remote storage.

Ashwin

Comments on this Answer

Comment made 24-Jul-2017 by Jad Tabbara (JTI) 2361

Hello Ashwin,

Thanks for you answer. Based on links that I shared in my question. other "F5 members" have already clarified the fact that it is not recommended to increase theses values.

But my question was to decrease it. Indeed, my hope is to change these values for example from 2 GB to 1 GB and from 3 million events to 1.5.

Please share the procedure.

Regards

Comment made 31-Jul-2017 by Jad Tabbara (JTI) 2361

Hello Ashwin,

Please could you share how to do it ?

Thanks

Comment made 10-Jul-2018 by Jerry Lees F5

I realize this is old, but could you clarify why you would like to decrease the size? Most people end up wanting to increase thee numbers when they ask about database sizes.

I can't think of a reason to make it smaller other than a system is running low on disk space, honestly, that's a completely different problem too. One that an additional 1Gb isn't going to solve long term.

Comment made 10-Jul-2018 by Jad Tabbara (JTI) 2361

Hello Jerry,

We noticed that incident management from the ASM GUI is very slow (RAM cosumption high) as soon as we have a large number of incidents. By decreasing the size from 2 GB to 1 GB or from 3 million entry to 1.5 million, I wanted to have a faster "admin" experience using the ASM GUI.

This was one of the need. Also we didn't wanted to retain to old incidents, since they are also sent to a SIEM, we wanted to keep only 1 year

Regards

Comment made 10-Jul-2018 by Jerry Lees F5

Hmmm, that's a tough one to troubleshoot without access to the system or configuration (don't post here). What version and hotfix? Also, did you open a support case? Are there any errors/events in the asm or ltm logs around this time? Is it just Request Event viewing or everything in the GUI (i.e. viewing Virtual Servers)?

If it's related to database size, I'm certain there would be a fix, if it isn't I'm certain you'd want to know, especially if it's still occurring.

USER ACCEPTED ANSWER & F5 ACCEPTED ANSWER

Updated 4 months ago•Originally posted on 10-Oct-2018 by Jeon Byeong Jun 2

how did you solve this case? i'm trying to change log size for asm. do you share soltion?

You must be logged in to answer. You can login here.

Learn F5 Technologies, Get Answers & Share Community Solutions Join DevCentral

Answers to this Question