Logging profiles determine where events are logged, and which items (such as which parts of requests, or which type of errors) are logged. Events can be logged either locally on the system and viewed in the Event Logs screens, or remotely by the client’s server. The system forwards the log messages to the client’s server using the Syslog service.

You can use one logging profile for Application Security, Protocol Security, Advanced Firewall, and DoS Protection. By default, the system includes two logging profiles that log data locally for Application Security: one to log all requests and another to log illegal requests. You can use the system-supplied logging profiles, or you can create a custom logging profile.

The logging profile records requests to the virtual server. By default when you create a security policy using the Deployment wizard, the system associates the log illegal requests profile to the virtual server associated with the policy. You can change which logging profile is associated with the security policy by editing the virtual server.

A logging profile has two parts: the storage configuration and the storage filter. The storage configuration specifies where to store the logs, either locally and/or remotely. The storage filter determines what information gets stored. For remote logging, you can send logging files for storage on a remote system (such as a syslog server), on a reporting server (as key/value pairs), or on an ArcSight server (in CEF format). Note that configuring external logging servers is not the responsibility of F5 Networks.

1. On the Main tab, click Security > Event Logs > Logging Profiles. The Logging Profiles list screen opens.
2. Click Create. The New Logging Profile screen opens.
3. In the Profile Name field, type a unique name for the profile.
4. Select the Application Security check box. The screen displays additional fields.
5. On the Application Security tab, for Configuration, select Advanced.
6. By default, logs are stored locally. The Local Storage check box is selected and cannot be cleared unless you enable Remote Storage to store logs remotely. This prevents you from creating a logging profile that does not log any traffic.
   • To store logs locally only, leave the Local Storage check box selected.
   • To store logs remotely, select the Remote Storage check box.
   • To store logs both places, select both check boxes.
7. Optional for local logging: To ensure that the system logs requests for the security policy, even when the logging utility is competing for system resources, select the Guarantee Local Logging check box.
8. From the Response Logging list, select one of the following options.

   Option	Description
   Off	Do not log responses.
   For Illegal Requests Only	Log responses for illegal requests.
   For All Requests	Log responses for all requests. when the Storage Filter Request Type is set to All Requests. (Otherwise, logs only illegal requests.)

   By default, the system logs the first 10000 bytes of responses, up to 10 responses per second. You can change the limits by using the response logging system variables.
9. By default, the system logs all requests. To limit the type of requests that the system or server logs, set up the Storage Filter.
10. If setting up local event logging only, click Finished. To set up remote logging, continue to set up remote logging.

1. On the Main tab, click Security > Event Logs > Logging Profiles. The Logging Profiles list screen opens.
2. Click the name of the logging profile for which you want to set up remote logging.
3. Select the Remote Storagecheck box.
4. From the Remote Storage Type list, select the appropriate type:
   • To store traffic on a remote logging server like syslog, select Remote. Messages are in syslog format.
   • To store traffic on a reporting server (for example, Splunk) using a pre-configured storage format, select Reporting Server. Key/value pairs are used in the log messages.
   • If your network uses ArcSight logs, select ArcSight. Log messages are in Common Event Format (CEF).
5. For the Protocol setting, select the protocol that the remote storage server uses: TCP (the default setting), TCP-RFC3195, or UDP.
6. If setting up local event logging only, click Finished. To set up remote logging, continue to set up remote logging. The selected protocol applies to all remote server settings on this screen, including all server IP addresses.
7. For Server Addresses, specify one or more remote servers, reporting servers, or ArcSight servers on which to log traffic. Type the IP Address, Port Number (default is 514), and click Add.
8. If using the Remote storage type, for Facility, select the facility category of the logged traffic. The possible values are LOG_LOCAL0 through LOG_LOCAL7.
   Tip: If you have more than one security policy you can use the same remote logging server for both applications, and use the facility filter to sort the data for each.
9. If using the Remote storage type, in the Storage Format setting, you can specify how the log displays information, which traffic items the server logs, and what order it logs them:
   1. To determine how the log appears, select Field-List to display the items in the Selected Items list in CSV format with a delimiter you specify; select User-Defined to display the items in the Selected Items list in addition to any free text you type in the Selected Items list.
   2. To specify which items appear in the log, move items from the Available Items list into the Selected Items list.
   3. To control the order in which predefined items appear in the server logs, select an item in the Selected Items list, and click the Up or Down button.
10. For Maximum Query String Size, specify how much of a request the server logs.
    • To log the entire request, select Any.
    • To limit the number of bytes that are logged per request, select Length and type the maximum number of bytes to log.
11. For Maximum Entry Length, specify how much of the entry length the server logs. The default length is 1K for remote servers that support UDP, and 2K for remote servers that support TCP and TCP-RFC3195. You can change the default maximum entry length for remote servers that support TCP.
12. If you want the system to send a report string to the remote system log when a brute force attack or web scraping attack starts and ends, select Report Detected Anomalies
13. In the Storage Filter area, make any changes as required.
14. Click Update (or Finished, whichever is appropriate).

1. Click Local Traffic > Virtual Servers
2. Click the name of the virtual server used by the security policy. The system displays the general properties of the virtual server.
3. From the Security menu, select Policies. The system displays the policy settings for the virtual server.
4. Ensure that the Application Security Policy setting is Enabled and that Policy is set to the security policy you want.
5. For Log Profile,
   1. Check that it is set to Enabled.
   2. From the Available list, select the profile to use for the security policy, and move it into the Selected list.
6. Click Update.

If you enable response logging in the logging profile, the system can log only responses that include the following content headers:

• "text/..."
• "application/x-shockwave-flash"
• "application/sgml"
• "application/x-javascript"
• "application/xml"
• "application/x-asp"
• "application/x-aspx"
• "application/xhtml+xml"
• "application/soap+xml"
• "application/json"

The system cannot log other responses.

If your network uses ArcSight logs, you can create a logging profile so that the log information is saved using the appropriate format. Application Security Manager stores all logs on a remote logging server using the predefined ArcSight settings for the logs. The log messages are in Common Event Format (CEF).

The basic format is:

1. On the Main tab, click Security > Event Logs > Logging Profiles. The Logging Profiles list screen opens.
2. In the Profile Name column, click the logging profile name for which you want to set up the filter.
   Note: This profile must be one that you created and not one of the system-supplied profiles, which cannot be edited.
   The Edit Logging Profile screen opens.
3. From the Storage Filter list, select Advanced. The screen displays additional settings.
4. For the Logic Operation setting, specify the filter criteria to use.

   Option	Description
   OR	Select this operator to log the data that meets one or more of the criteria.
   AND	Select this operator to log the data that meets all of the criteria.

5. For the Request Type setting, select the requests that you want the system to store in the log, All Requests or Illegal Requests Only.
6. For the Protocols setting, select whether logging occurs for both HTTP and HTTPS protocols or a specific protocol.
7. For the Response Status Codes setting, select whether logging occurs for all response status codes or only for specific ones.
8. For the HTTP Methods setting, select whether logging occurs for all methods or only for specific ones.
9. For the Request Containing String setting, select whether the request logging is for any string or dependent on a specific string that you specify.
10. Click Update.

1. Click System > Logs
2. Click Application Security.