ASM Event Log Requests

Question

Hi,
I'm Using Bigip ASM Ver 13.1.0.6.
I Have a problem with the ASM requests log, it getting too large over 4 milion requesst and we can't search anything in it, every search lead to a system error that says: "Failed to Load Request", when i try to delete all logs from the WEBUI it failed and let me delete only 10000 request each time...
i know that the logs stores in the db and i wondered if there is any workaround to clean all the request log directly from the db or if there is any other way to clean them up.
thx.&nbsp;

g-ram_31429 · Answer

Hope this helps -&nbsp;
https://support.f5.com/csp/article/K11370&nbsp;

g-ram · Answer

Hope this helps -&nbsp;
https://support.f5.com/csp/article/K11370&nbsp;

g-ram_31429 · Answer

https://support.f5.com/csp/article/K6992 - this one re-initializes the ASM database - &nbsp;

g-ram · Answer

https://support.f5.com/csp/article/K6992 - this one re-initializes the ASM database - &nbsp;

suttonsc · Answer

The Request logs are managed by size in "/etc/ts/tools/asmlogd.cfg" and by row limit in "/etc/ts/tools/asmlogd_clean_db.yaml".&nbsp;
It sounds like the clean up may not have happened/be happening correctly to allow it to get to 4 million rows. This should be limited to 3000000 (3 million) rows.&nbsp;
To reduce the size of the requests you can reduce the size in the asmlogd.cfg and the row limit in the asmlogd_clean_db.yaml then reload ASM.&nbsp;
The steps in https://support.f5.com/csp/article/K11370 are for pre 11.6 when tables and storage management methods are changed.&nbsp;
The steps in https://support.f5.com/csp/article/K6992 will completely reset the ASM configuration not just log data.&nbsp;

Forum Discussion

ASM Event Log Requests

5 Replies

Recent Discussions

Overwriting or adding LTM SSL Traffic cert and key using iControlREST

Pricing when used with aws waf

F5 terminal - help to run commands - disk space full

import live updates from version x to version y

Tenant image upgrade

Related Content

asmevents tool to retrieve events from an ASM device

How to make DNS resolutions in an HTTP request event work FOR you, not against you

ASM Too many concurrent long requests

F5 BIG-IP Automatic email notification for system update events (ASM/AWAF)

Export single ASM Event Log over API