Forum Discussion

g0a_359464's avatar
g0a_359464
Icon for Nimbostratus rankNimbostratus
May 11, 2018

Session Tracking in the ASM

I want to implement the session tracking feature in the ASM by setting a session threshold. To determine this threshold I wanted to know how the ASM maintains state information. Is it through the TS cookie (Main ASM cookie) ? I see a session id in the event logs for ASM. Can I expose this session id to remote log server through an iRule for any violations ? This would help me calculate my threshold. Or should this be done through the Main ASM cookie ?

 

ASM Advanced WAF
devops
iRules
security

1 Reply

Sort By
  • Romani_2788's avatar
    Romani_2788
    Historic F5 Account
    May 17, 2018

    Yes, ASM maintains state information with the Main ASM Cookie, the TS Cookie, and this is tied to the sessionID you see in the event logs.

     

    I do not believe the sessionID itself is exposed via an irule however (see the page on ASM::violation_data), however, you should simply get this information logged remotely anyway when you use remote logging, without needing to extract it within an iRule.

     

    Have a look at this manual on Logging Application Security Events.