Learn F5 Technologies, Get Answers & Share Community Solutions Join DevCentral

Filter by:
  • Solution
  • Technology
Answers

ID, Event Logs, Half a day, Expand

Dear All,

I used block mode in ASM now. But when I would like to search ID in Event logs/Application/Requests, I can search in half day events. So my ASM storaged half a day events. Can I expand this? for example to a week.

Thanks,

0
Rate this Question

Answers to this Question

placeholder+image
USER ACCEPTED ANSWER & F5 ACCEPTED ANSWER

The size or the capacity of the event logs cannot be modified.

But what is likely responsible for the behavior that you are seeing is the volume of traffic been processed by ASM and how many of that is actually been logged. Since the capacity of the event logs is fixed, the requests will be dropped from a first in first out basis, and the quicker the event logs fill up the quicker older entries are deleted, thereby resulting in the device keeping only half a day's worth of event logs.

This behavior is made worse when all requests are been logged versus logging only illegal requests. This will be a call you will have to make if you want to keep logging on the device, alternative will be for you to log off-box.

0