Creating logging profiles

1. Click Create on the Logging Profiles screen. The Logging Profiles - New Item screen displays.
2. In the Logging Profiles - New Item screen, review and add or modify the properties as appropriate.

   Property	Description
   Name	Specifies a unique user-provided name for the logging profile. Required.
   Description	Specifies the optional description for the logging profile.
   Partition	Specifies the partition to which the logging profile belongs. Required. Only users with access to a partition can view the objects (such as the logging profile) that it contains. If the logging profile resides in the Common partition, all users can access it. Although this field is pre-populated with Common (default), you can set the partition when creating logging profiles by typing a unique name for the partition. Note: The partition with that name must already exist on the BIG-IP® device. No whitespace is allowed in the partition name.

3. Select Enabled to the right of one or more logging types to enable those types. A configuration tab is added dynamically when a logging type is selected. Click the tab to configure the logging type.

   Property	Description
   Application Security	When enabled, specifies that the system logs traffic to the web application. When Application Security is enabled, Protocol Security cannot be selected at the same time. Click Application Security to configure the application security log. Application Security includes processing one or more of the following: Configuration Storage Filter
   Protocol Security	When enabled, specifies that the system logs any dropped, malformed, and/or rejected requests sent through the given protocol. When Protocol Security is enabled, Application Securitycannot be selected at the same time. Protocol Security includes processing one or more of the following: HTTP, FTP, and SMTP Security DNS Security SIP Security
   Network Firewall	When enabled, specifies that the system logs ACL rule matches, TCP events, and/or TCP/IP errors sent to the network firewall. Includes processing one or more of the following: Network Firewall IP Intelligence Traffic Statistics
   Network Address Translation	When enabled, specifies which Network Address Translation (NAT) events the system logs, and where those events are logged.
   DoS Protection	When enabled, specifies that the system logs detected DoS attacks, and where DoS events are logged. Includes processing one or more of the following: DoS Application Protection DNS DoS Protection SIP DoS Protection Network DoS Protection

4. Configure the logging types by clicking the matching logging type tab and supplying any necessary property values. (Properties are grouped by logging type and screen area in the following tables.)

   In the Application Security Configuration section, you configure settings determining where to log traffic and which traffic to log.

   Application Security - Configuration	Description
   Local Storage	Specifies when Enabled is selected, that the system stores all traffic in the system.
   Guarantee Local Logging	Specifies when Enabled is selected, that the system logs all requests, even though this may slow your web application. When cleared (disabled), specifies that the system logs requests as long as it does not slow your web application. The default is disabled. In either case, the system does not drop requests.
   Response Logging	Specifies whether the system logs HTTP responses. Off: Specifies that the system does not log responses. This is the default setting. For Illegal Requests Only: Specifies that the system logs responses to illegal requests. For All Requests: Specifies that the system logs all responses if the Request Type setting in the Storage Filter area of this screen is set to All Requests.
   Remote Storage	Specifies when Enabled is selected, that the system stores all traffic on a remote logging server. Selecting this option enables additional remote storage options. Logging Format: Specifies the logging format for the remote storage: Select Comma-Separated Values to store traffic on a remote logging server like syslog. Messages are in syslog CSV format. Select Key-Value Pairs to store traffic on a third party reporting server (for example, Splunk) using a pre-configured storage format. Key value pairs are used in the log messages. Select Common Event Format (ArcSight) if your network uses ArcSight servers. Log messages are in Common Event Format (CEF). Select BIG-IQ if you are using a BIG-IQ system as your logging server and you are using a BIG-IP device version 12.0 or higher that has enabled the option to use a BIG-IQ system as a logging server. The logging format you select determines what other options are displayed. Protocol: Specifies the protocol that the remote storage server uses: TCP (the default setting) TCP-RFC3195 UDP Server Addresses: Specifies one or more remote servers, reporting servers, ArcSight servers or BIG-IQ systems on which to log traffic. Type the values for the IP Address and Port, and click Add for each server. Note: The default value for Port is 514 for all types of remote storage other than BIG-IQ. If BIG-IQ is selected for the Remote Storage Type, the default port value is 8514. Facility: Specifies the facility category of the logged traffic. The possible values are LOG_LOCAL0 through LOG_LOCAL7. Note: If you have more than one security policy, you can use the same remote logging server for both applications, and use the facility filter to sort the data for each. Storage Format: Specifies how the log displays information and which traffic items the server logs, and what order it logs them: To determine how the log appears, select Field-List to display the items in the Selected list in CSV format with a delimiter you specify; select User-Defined to display the items in the Selected list in addition to any free text you type in the Selected list. To specify which items appear in the log and in what order, move items from the Available list into the Selected list. Maximum Query String Size: Specifies how much of a request the server logs. Select Any to log the entire request. Select Length and type the maximum number of bytes to log to limit the number of bytes that are logged per request. The value you specify for Length must be less than the value specified for Maximum Entry Length. Maximum Entry Length: Specifies how much of the entry length the server logs. The default length is 1K for remote servers that support UDP, and 2K for remote servers that support TCP and TCP-RFC3195. You can change the default maximum entry length for remote servers that support TCP. Report Detected Anomalies: Select Enabled if you want the system to send a report string to the remote system log when a brute force attack or web scraping attack starts and ends.

   In the Application Security Storage Filter section, you configure settings for the type of requests the system, or server, logs.

   Application Security - Storage Filter	Description
   Logic Operation	Specifies whether requests must meet one or all criteria in the Storage Filter area for the system, or server, to log the requests. OR: Specifies that requests must meet at least one of the criterion in the Storage Filter settings in order for the system, or server, to log the requests. This is the default. AND: Specifies that requests must meet all of the criteria in the Storage Filter settings in order for the system, or server, to log the requests.
   Request Type	Specifies which kind of requests the system, or server, logs. Illegal requests only: Specifies that the system, or server, logs only illegal requests. This is the default. Illegal requests, and requests that include staged attack signatures: Specifies that the system, or server, logs illegal requests, and logs requests that include attack signatures in staging (even though the system considers those requests legal). All requests: Specifies that the system, or server, logs all requests.
   Protocols	Specifies whether request logging occurs for all protocols or only for selected protocols. All: Specifies that the system, or server, logs requests for both HTTP and HTTPS protocols. This is the default. Only: Specifies that the system, or server, logs requests for only the specified protocol. Select HTTP or HTTPS.
   Response Status Codes	Specifies whether request logging occurs for all response status codes or only for selected response status codes. This setting applies only to requests that are not blocked by the system. All: Specifies that the system, or server, logs all requests that generate all response status codes. This is the default. Only: Specifies that the system, or server, logs only requests that generate specific response status codes. When selected, displays additional options where you specify the type of response status code to log. Unused status codes are in the Available list, selected status codes are in the Selected list. Use the Move arrow buttons to transfer the selected items between the Available list and the Selected list.
   HTTP Methods	Specifies whether request logging occurs for all HTTP methods or only for selected HTTP methods. All: Specifies that the system, or server, logs requests for all HTTP methods. This is the default. Only: Specifies that the system, or server, logs requests for the specified HTTP method. When selected, displays options where you specify the type of HTTP method to log. Unused HTTP methods are in the Available list, selected HTTP methods are in the Selected list.
   Request Containing String	Specifies whether the request logging is dependent on a specific string. All: Specifies that the system logs all requests, regardless of string. This is the default. Search In: Specifies that the system logs only requests containing a specific string in a particular part of the request. Select the part of the request to search from the list (Request, URI, Query String, Post Data, or Headers). Type the string to search for in the request in the field to the right. The search is case-sensitive.

   In the Protocol Security HTTP, FTP, and SMTP Security area, you configure where the system logs requests using the HTTP, FTP, and SMTP protocols.

   Protocol Security - HTTP, FTP, and SMTP Security	Description
   Publisher	Specifies where the system sends log messages. Select a publisher from the list, or accept the default of None.

   In the Protocol Security DNS Security area, you configure where the system logs any dropped, malformed, rejected, and malicious DNS requests.

   Protocol Security - DNS Security	Description
   Publisher	Specifies the name of the log publisher used for logging DNS security events. Select a log publisher from the list, or accept the default of None.
   Log Dropped Requests	Specifies, when enabled, that the system logs dropped DNS requests.
   Log Filtered Dropped Requests	Specifies, when enabled, that the system logs filtered dropped DNS requests.
   Log Malformed Requests	Specifies, when enabled, that the system logs malformed DNS requests.
   Log Rejected Requests	Specifies, when enabled, that the system logs rejected DNS requests.
   Log Malicious Requests	Specifies, when enabled, that the system logs malicious DNS requests.
   Storage Format	Specifies the format type for log messages. You can configure the following options: None Specifies that the system uses the default format type to log the messages to a Remote Syslog server. This is the default setting. Field-List Specifies that the system uses a set of fields, set in a specific order, to log messages. When Field-List is selected, specify the field list as follows. Specify the delimiter string in the Delimiter field. The default delimiter is the comma character (,). Note: You may not use the $ character because it reserved for internal usage. Select the fields to use. Unused fields are in the Available list, selected fields are in the Selected list. Use the Move arrow buttons to transfer the selected items between the lists. User-Defined Specifies that the format the system uses to log messages is in the form of a user-defined string. Select the items for the server to log. Unused items are in the Available list, selected items are in the Selected list. Use the Move arrow buttons to transfer the selected items between the lists.

   In the Protocol Security SIP Security section, you configure where the system logs any dropped and malformed malicious SIP requests, global and request failures, redirected responses, and server errors.

   Protocol Security - SIP Security	Description
   Publisher	Specifies the name of the log publisher used for logging SIP protocol security events. Select a log publisher configured in your system.
   Log Dropped Requests	Specifies, when enabled, that the system logs dropped requests.
   Log Global Failures	Specifies, when enabled, that the system logs global failures.
   Log Malformed Requests	Specifies, when enabled, that the system logs malformed requests.
   Log Redirection Responses Requests	Specifies, when enabled, that the system logs redirection responses.
   Log Request Failures	Specifies, when enabled, that the system logs request failures.
   Log Server Errors	Specifies, when enabled, that the system logs server errors.
   Storage Format	Specifies the format type for log messages. You can configure the following options: None Specifies that the system uses the default format type to log the messages to a Remote Syslog server. This is the default setting. Field-List Specifies that the system uses a set of fields, set in a specific order, to log messages. When Field-List is selected, specify the field list as follows. Specify the delimiter string in the Delimiter field. The default delimiter is the comma character (,). Note: You may not use the $ character because it reserved for internal usage. Select the fields to use. Unused fields are in the Available list, selected fields are in the Selected list. Use the Move arrow buttons to transfer the selected items between the lists. User-Defined Specifies that the format the system uses to log messages is in the form of a user-defined string. Select the items for the server to log. Unused items are in the Available list, selected items are in the Selected list. Use the Move arrow buttons to transfer the selected items between the lists.

   In the Network Firewall section, you configure which network firewall events the system logs, and where they are logged.

   Network Firewall Security - Network Firewall	Description
   Publisher	Specifies the name of the log publisher used for logging Network events. Select a log publisher configured in your system.
   Aggregate Rate Limit	Defines a rate limit for all combined network firewall log messages per second. Beyond this rate limit, log messages are not logged. You can select a Rate Limit value of Indefinite, which sets the rate limit to the maximum of 4294967295, or you can select Specify to specify a lower rate limit as an integer between 0 and 4294967295.
   Log Rule Matches	Specifies, when enabled, that the system logs packets that match the ACL rules. Accept Specifies, when enabled, that the system logs packets that match ACL rules configured with action = Accept. Drop Specifies, when enabled, that the system logs packets that match ACL rules configured with action = Drop. Reject Specifies, when enabled, that the system logs packets that match ACL rules configured with action = Reject. When specifying the Rate Limit for all network firewall log messages of one of the match types: A value of Indefinite sets the rate limit to the maximum of 4294967295, and a value of Specify allows you to specify a lower rate limit as an integer between 0 and 4294967295. If the rate limit is exceeded, log messages of the matched action type are not logged until the threshold drops below the specified rate.
   Log IP Errors	Specifies, when enabled, that the system logs IP error packets. When enabled, you can specify a rate limit for all network firewall log messages of this type. If this rate limit is exceeded, log messages of this type are not logged until the threshold drops below the specified rate. You can select a Rate Limit value of Indefinite, which means the rate limit is set to the maximum of 4294967295, or you can select Specify and specify an integer between 0 and 4294967295 that represents the number of messages per second.
   Log TCP Errors	Specifies, when enabled, that the system logs TCP error packets. If this rate limit is exceeded, log messages of this type are not logged until the threshold drops below the specified rate. You can select a Rate Limit value of Indefinite which means the rate limit is set to the maximum of 4294967295, or you can select Specify and specify an integer between 0 and 4294967295 that represents the number of messages per second.
   Log TCP Events	Specifies, when enabled, that the system logs TCP events (open and close of TCP sessions). If this rate limit is exceeded, log messages of this type are not logged until the threshold drops below the specified rate. You can select a Rate Limit value of Indefinite which means the rate limit is set to the maximum of 4294967295, or you can select Specify and specify an integer between 0 and 4294967295 that represents the number of messages per second.
   Log Translation Fields	Specifies, when enabled, that translation values are logged if and when a network firewall event is logged.
   Always Log Region	Specifies, when enabled, that the geographic location should be logged when a geolocation event causes a network firewall event.
   Storage Format	Specifies the format type for log messages. You can configure the following options: None Specifies that the system uses the default format type to log the messages to a Remote Syslog server. This is the default setting. Field-List Specifies that the system uses a set of fields, set in a specific order, to log messages. When Field-List is selected, specify the field list as follows. Specify the delimiter string in the Delimiter field. The default delimiter is the comma character (,). Note: You may not use the $ character because it reserved for internal usage. Select the fields to use. Unused fields are in the Available list, selected fields are in the Selected list. Use the Move arrow buttons to transfer the selected items between the lists. User-Defined Specifies that the format the system uses to log messages is in the form of a user-defined string. Select the items for the server to log. Unused items are in the Available list, selected items are in the Selected list. Use the Move arrow buttons to transfer the selected items between the lists.

   In the Network Firewall Security IP Intelligence section, you configure where IP intelligence events are logged. If the IP intelligence feature is enabled and licensed, you can configure the system to log source IP addresses that match an IP intelligence blacklist or whitelist category, as determined by the database of preconfigured categories, or as determined from an IP intelligence feed list.

   Network Firewall Security - IP Intelligence	Description
   Publisher	Specifies the name of the log publisher used for logging IP address intelligence events. Select a log publisher configured in your system.
   Aggregate Rate Limit	Defines a rate limit for all combined IP intelligence log messages per second. Beyond this rate limit, log messages are not logged until the threshold drops below the specified rate. You can select a Rate Limit value of Indefinite which means the rate limit is set to the maximum of 4294967295, or you can select Specify and specify an integer between 0 and 4294967295 that represents the number of messages per second.
   Log Translation Fields	Specifies, when enabled, that translation values are logged if and when a network firewall event is logged.

   In the Network Firewall Security Traffic Statistics section, you configure logging of traffic statistics.

   Network Firewall Security - Traffic Statistics	Description
   Publisher	Specifies the name of the log publisher used for logging traffic statistics. Select a log publisher configured in your system.
   Log Timer Events	Active Flows - When enabled, logs the number of active flows each second. Reaped Flows - When enabled, logs the number of reaped flows, or connections that are not established because of system resource usage levels. Missed Flows - When enabled, logs the number of packets that were dropped because of a flow table miss. A flow table miss occurs when a TCP non-SYN packet does not match an existing flow. SYN Cookie (Per Session Challenge) - When enabled, logs the number of SYN cookie challenges generated each second. SYN Cookie (White-listed Clients) - When enabled, logs the number of whitelisted SYN cookie clients each second.

   In the Network Address Translation (NAT) section, you configure which NAT events the system logs, and where they are logged.

   Network Address Translation	Description
   LNS Legacy Mode	Specifies, when enabled, that events be logged in Carrier Grade Network Address Translation (CGNAT) LSN format for backward compatibility. If not enabled, the newer HSL logging format is used, which is the default.
   Start Outbound Session	Specifies whether to log the event for the start of an outbound translation session, when the outbound flow is created. Select Enabled to log Start Outbound Session events. Select Disabled to not log Start Outbound Session events. This is the default. Select Backup Allocation Only to log the translation event if the translation occurred due to backup addresses being configured in a NAT Source Translations object. You create such backup addresses in NAT Source Translations by setting the Type to Dynamic PAT, the PAT Mode to Deterministic, and then supplying addresses in the Backup Addresses property.
   End Outbound Session	Specifies whether to log the event for the end of an outbound translation session, when the outbound flow is deleted. Select Enabled to log End Outbound Session events. Select Disabled to not log End Outbound Session events. This is the default. Select Backup Allocation Only to log the translation event if the translation occurred due to backup addresses being configured in a NAT Source Translations object. You create such backup addresses in NAT Source Translations by setting the Type to Dynamic PAT, the PAT Mode to Deterministic, and then supplying addresses in the Backup Addresses property.
   Start Inbound Session	Specifies whether to log the event for the start of an incoming connection to a translated address. Select Enabled to log Start Inbound Session events. Select Disabled to not log Start Inbound Session events. This is the default. Select Backup Allocation Only to log the translation event if the translation occurred due to backup addresses being configured in a NAT Source Translations object. You create such backup addresses in NAT Source Translations by setting the Type to Dynamic PAT, the PAT Mode to Deterministic, and then supplying addresses in the Backup Addresses property.
   End Inbound Session	Specifies whether to log the event for the end of an incoming connection to a translated address. Select Enabled to log End Inbound Session events. Select Disabled to not log End Inbound Session events. This is the default. Select Backup Allocation Only to log the translation event if the translation occurred due to backup addresses being configured in a NAT Source Translations object. You create such backup addresses in NAT Source Translations by setting the Type to Dynamic PAT, the PAT Mode to Deterministic, and then supplying addresses in the Backup Addresses property.
   Quota Exceeded	Specifies whether to log when a client exceeds the allocated resource limit. Select Enabled to log when a client exceeds the allocated resource limit. Select Disabled to not log when a client exceeds the allocated resource limit. This is the default.
   Errors	Specifies whether to log when errors are encountered while attempting translation for clients. Select Enabled to log when errors are encountered while attempting translation for clients. Select Disabled to not log when errors are encountered while attempting translation for clients. This is the default.
   Publisher	Specifies the name of the log publisher used for logging NAT events. Select a log publisher configured in your system.

   In the DoS Protection sections, you configure where DoS events are logged.

   DoS Protection - DoS Application Protection	Description
   Local Publisher	Specifies, when enabled, that the system logs DoS events to the local database.
   Remote Publisher	Specifies the name of the log publisher used for logging DoS events. Select a log publisher configured in your system.

   DoS Protection - DNS DoS Protection	Description
   Publisher	Specifies the name of the log publisher used for logging DNS DoS events. Select a log publisher configured in your system.

   DoS Protection - SIP DoS Protection	Description
   Publisher	Specifies the name of the log publisher used for logging SIP DoS events. Select a log publisher configured in your system.

   DoS Protection - Network DoS Protection	Description
   Publisher	Specifies the name of the log publisher used for logging Network DoS events. Select a log publisher configured in your system.

5. When finished, save your changes in one of two ways:
   • Click Save to save the logging profile.
   • Click Save & Close to save the logging profile and return to the Logging Profiles screen.