Smarter by Design.Simpler for Business
TR7Enterprise Application Delivery & Security Platform
Can I see the Bot/DDoS events of all vServices on one screen (Global Event Log)?
Short answer
Yes. The Global Event Log screen opened in the Configuration Menu through Bot/DDoS → Global Event Log gathers the Event Logs records of all vServices with Bot/DDoS protection enabled in a single table. The columns, filters and preview are the same as on the vService's Event Logs screen; the differences are the vService column at the beginning of the table (clicking the name opens that vService's Bot/DDoS Dashboard), the vService tab on the filter strip, the vService field in the server filter that narrows the scan (All vServices or Pick vServices) and the default Line Limit of 5,000 rows (at most 50,000). The scan proceeds from the newest record to older ones and stops when the row limit is full; if the time was not enough, the Results are complete back to … warning is displayed above the list. The screen requires monitoring permission in the Load Balancer area and does not appear in the menu on accounts whose permission is limited to certain vServices.
Problem: The Events Are on Separate Screens per vService
The Event Logs tab of each vService shows only the events of that vService. To see that the same source is trying more than one application, to find the record when only a request ID is at hand, or to measure the effect of a limit across all applications, the screens have to be visited one by one.
Solution
Global Event Log
- How it worksGlobal Event Log scans the selected time range in the event files of all vServices in slices from the newest to the oldest (the first slice is one hour, doubling at each round up to at most 24 hours); it stops when the Line Limit is full or when the time budget runs out.
- Where it is openedBot/DDoS → Global Event Log
- Requirement Monitoring permission in the Load Balancer area; an account whose permission is not limited to certain vServices (how to access)
- vService type HTTP and L7 TCP (the vServices with Bot/DDoS protection enabled are scanned)
Step-by-Step Configuration
1
Adım 1 Open the screen
The Configuration Menu is opened with the TR7 logo at the bottom left and Bot/DDoS → Global Event Log is selected. The list is fetched automatically with the last used scope.
2
Adım 2 Open the server filter tab
The fixed tab at the beginning of the filter strip is clicked; the tab contains the Date Range, Line Limit, Request Unique ID, vService and Log Filter fields (determining the scan scope).
3
Adım 3 Select the vServices to scan (if needed)
With the default All vServices, the vService field scans all vServices with Bot/DDoS protection enabled. If the affected vServices are known, Pick vServices is selected and the vServices are checked; the event files of those not selected are not opened at all, and the whole row limit is spent on the selected ones.
4
Adım 4 Set the time range and the row limit
Date Range is kept narrow; Line Limit is entered as needed (default 5,000, at most 50,000). On this screen, the row limit is also the stopping condition of the scan; enlarging the limit makes the scan longer. If a request ID is at hand, it is written in the Request Unique ID field; the record is found without knowing which vService it belongs to.
5
Adım 5 Save and list
Save & Get Logs is clicked.
After the list is fetched, the rows are narrowed with tabs on the filter strip such as vService, Client IP, Country, Network Type and Action; the vService tab on the strip filters not the scan but only the fetched rows. The operations in the preview of a row (opening the setting, adding an exemption) work on the row's own vService (operations).
Verification
1ListTR7 side
The vService column at the beginning of the table and the information strip above the list are examined.
Expected
Rows belonging to different vServices; no strip, or Results are complete back to …If the strip appears, the list is complete back to the date written; for older records, Date Range is narrowed and the scan is run again.
Common Mistakes
- Starting the search with a wide time range. The scan has a time budget; if the range is wide, the list stays partial and the Results are complete back to … — narrow the range to go deeper warning is displayed. The search is deepened by narrowing the range.
- Saying "there is no record" without looking at the scope warning. If there is a warning, the record looked for may be in an older slice that was not scanned (the working of the scan).
- Trying to narrow the scan with the vService tab on the filter strip. The strip filters only the fetched rows; the scan is narrowed by the vService field in the server filter.
- Starting many global scans at the same time. At most two global scans run at the same time; this quota is shared with Global WAF Event Log and Global WAF Report. While the quota is full, the Another global scan is running right now — please try again shortly warning is received.
- Looking for the screen with a vService-restricted account. It does not appear in the menu on accounts whose permission is limited to certain vServices; these accounts use the Event Logs tab of their own vServices.
- Overlooking the writing budget warning. The Event logging was rate-capped in … hour slice(s) warning shows that the hourly writing budget on the source side was full in those hours and that no rows were written after that; the real volume is read with Live Stats and Dashboard.
- Looking for the rows of a protection that is off. The screen reads only events that have been written; on a vService where a protection is Off, the rows of that protection are never produced.
How it is done in the documentation
