In large customer environments, multiple users make changes to security policies. These policy changes occur in a central location, such as the BIG-IQ Web Application Security database, and not on individual BIG-IP ASM devices. To address possible concerns, the BIG-IQ system provides an audit log that records all traffic (users, times, events, and so on). Users who can access the BIG-IQ console (shell) have access to this file.

The BIG-IQ system records every change (every configuration change to a working-configuration object) in the audit log. A change is defined as: any object created, object deleted, or object modified. Thus, the audit log is an important tool for debugging and tracking changes to devices.

The audit log viewer in BIG-IQ Web Application Security displays these properties.

1. To examine audit logs using SSH, log in to the BIG-IQ system with Administrator or Security_Manager credentials.
2. Navigate to the audit log location: /var/log/audit.
3. Examine files with the naming convention: audit.n.txt. In this example, n is the log number.
4. Once located, you can view or save the log locally through a method of your choice.

1. To examine audit logs using the GUI, log in to the BIG-IQ system with Administrator or Security_Manager credentials.
2. Under Web Application Security, click Audit Logs. Each entry listed represents the result of a signature file Update & push task.
3. To see the list of steps that occurred for that specific task, click the Details link.