Create a New Log Profile

Create a log profile to detect security events

Creating logging profile for event monitoring

A logging profile records requests to a virtual server. You can determine which requests to log, and where to store the request information. The L7 Summary Dashboard (Monitoring > DASHBOARDS > L7 Security) lists the applications and virtual servers attached to a log profile. Use this dashboard to create new log profiles based on the requirements of the objects listed on the screen.

For more information, refer to the Managing Logging Profiles in Shared Security topics in BIG-IQ Centralized Management: Security on support.f5.com.

Create a logging profile for application security

Your system must have the following configuration to view event logs:

• Discover and activate a BIG-IQ Data Collection Device.
• Configure a BIG-IP device to collect event logs and send them to the BIG-IQ Centralized Management Data Collection Device. Part of this configuration includes a virtual server configured with a logging profile.
• Configure a logging profile for Web Application Security, assign it to a virtual server, and deploy it to the BIG-IP device that has been configured to collect log events. A logging profile is used to determine which events the system logs, and where, and the format of these events. It then directs security events to a BIG-IQ Data Collection Device, and the BIG-IQ Centralized Management system retrieves them from that node.

You create logging profiles to specify the kind of information to log for objects that support logging.

1. Go to Monitoring > EVENTS > Web Application Security > Events.

   To view a logging profile of a specific protected object, go to Monitoring > DASHBOARDS > L7 Dashboard and select the logging profile link associate with the object in the dashboard’s list.

2. Click Create and select Log Profile.

   The New Logging Profile screen opens with the Properties displayed.

3. Type a Name for the logging profile.

4. Type an optional Description for the logging profile.

5. If needed, change the default Common partition in the Partition field.

   The partition with that name must already exist on the BIG-IP device. No whitespace is allowed in the partition name. Only users with access to a partition can view the objects (such as the logging profile) that it contains. If the logging profile resides in the Common partition, all users can access it.

6. For Application Templates, specify whether the profile is available to application templates.

   • To make the profile available to application templates, select the Make available check box.
   • To keep the profile from being available to application templates, clear the check box.

7. On the left, click the logging type that you want to use, and then select the Enabled check box to display the related settings.

   • Enable APPLICATION SECURITY to specify that the system logs traffic to the web application. You cannot enable both APPLICATION SECURITY and PROTOCOL SECURITY. Refer to the Configure for Application Security logging section of BIG-IQ Centralized Management: Security on support.f5.com for configuration information.
   • Enable PROTOCOL SECURITY to specify that the system logs any dropped, malformed, and/or rejected requests sent through the given protocol. Refer to the Configure for Protocol Security logging section of BIG-IQ Centralized Management: Security on support.f5.com for configuration information.
   • Enable NETWORK FIREWALL to specify that the system logs ACL rule matches, TCP events, and/or TCP/IP errors sent to the network firewall. Refer to the Configure for Network Firewall logging section of BIG-IQ Centralized Management: Security on support.f5.com for configuration information.
   • Enable NETWORK ADDRESS TRANSLATION to specify which Network Address Translation (NAT) events the system logs, and where those events are logged. Refer to the Configure for Network Address Translation logging section of BIG-IQ Centralized Management: Security on support.f5.com for configuration information.
   • Enable DOS PROTECTION to specify that the system logs detected DoS attacks, and where DoS events are logged.
   • Enable BOT DEFENSE to specify that the system logs bot defense events. Refer to the Configure for Bot Defense logging section of BIG-IQ Centralized Management: Security on support.f5.com for configuration information. You must configure each enabled logging type before you can use it. You can do that now, or save the profile and configure the logging types later.

8. Specify the settings needed for each logging type you use.

   You can configure multiple logging types while editing the logging profile.

9. When finished, save your changes.

The newly created log profile is added to your list of log profiles. At this point, you can add it to any object that requires a security logging profile.