Forum Discussion

gh0st_325958's avatar
gh0st_325958
Icon for Nimbostratus rankNimbostratus
Feb 08, 2018

ID, Event Logs, Half a day, Expand

Dear All,

 

I used block mode in ASM now. But when I would like to search ID in Event logs/Application/Requests, I can search in half day events. So my ASM storaged half a day events. Can I expand this? for example to a week.

 

Thanks,

 

1 Reply

  • Romani_2788's avatar
    Romani_2788
    Historic F5 Account

    The size or the capacity of the event logs cannot be modified.

     

    But what is likely responsible for the behavior that you are seeing is the volume of traffic been processed by ASM and how many of that is actually been logged. Since the capacity of the event logs is fixed, the requests will be dropped from a first in first out basis, and the quicker the event logs fill up the quicker older entries are deleted, thereby resulting in the device keeping only half a day's worth of event logs.

     

    This behavior is made worse when all requests are been logged versus logging only illegal requests. This will be a call you will have to make if you want to keep logging on the device, alternative will be for you to log off-box.