What does the "Detailed Log" option do; is a log written if I turn it off?

Short answer

Detailed Log manages only the detail of signature (OWASP) hits in the record. While it is on, the Description field on the Attacks tab of the Event Logs record shows the matching content together with its surroundings; while it is off, the record is still written, the score and the blocking decision do not change, and Detailed log disabled is written in the Description field. The summary of structural violations (e.g. 2000>1024, the violating name or the value that does not match the pattern) is always written, independently of this setting. The setting is found per common rule and argument rule in the Query, Header, JSON, Xml, Form and Raw tabs; it does not exist in the Path tab, and path hits are always written in detail. In the Any paths rule, it is off for JSON and on for the other sections. The attack payload sent to SIEM follows this setting while the Attack Payload in WAF Info field is Same as 'detailed log'.

How Does It Work?

	Detailed log on	Detailed log off
Is the record written	Yes	Yes
Score and blocking decision	Do not change	Do not change
Description in a signature hit	The matching content and its surroundings, with the matching part highlighted	Detailed log disabled
Structural violation summary	Written	Written
SIEM attack payload (while Same as 'detailed log' is selected)	Sent	Not sent

• The setting is valid for the parameter or section where the hit is caught: on a parameter that has an argument rule, the Detailed Log value of that rule is used, and on the others, that of the common rule.
• File contents and the whole multipart body are written with the Detailed Log value of the Raw tab (Is the content of uploaded files scanned as well (OWASP Check in Upload)?).
• If Always Send is selected in the Attack Payload in WAF Info field, the attack payload is always sent independently of this setting, and if Never Send is selected, it is never sent (Is the attack payload sent to the SIEM (Same as 'detailed log' / Always Send / Never Send)?).
• The writing of the request body to the record, on the other hand, is managed with a separate setting, Max. Body Size to Log(kB) (How is a body that exceeds the Max. Body Size to Log(kB) limit written to the log; should I raise this limit?).

Detailed Log in TR7

• Defaults: In the Any paths rule, Detailed log is off in the JSON common rule; it is on in the Query, Header, Xml, Form and Raw common rules and in the 21 default header rules. A common or argument rule form opened in a page type comes with the Any paths values; the WEB-CLI add command, on the other hand, writes it as on (--argLog true) in every section.
• Changing: In the Left Monitor Panel → WAF-Protected vServices → vService → WAF Management → N page types → rule → tab path, the Detailed log box is checked or unchecked in the Add common rule for … form or in the Edit form of the argument rule, and the form is saved with Add / Edit. In WEB-CLI, the field is named --argLog (common fields in every region).
• Seeing it in the record: On the Event Logs screen, the record is selected and the Description row of the attack on the Attacks tab is checked (What do I see in a log record's details (Summary, Attacks, Request & Location)?).

Common Misconceptions

• "While it is off, no record is written." The record, the score and the blocking decision do not change; only the content that matches the signature is not written to the record.
• "The setting also manages the writing of the request body to the record." The body excerpt is managed with Max. Body Size to Log(kB); Detailed log affects only the slice the signature matched.
• "If the content is not visible in JSON hits, the record is broken." Since Detailed log comes off for JSON in the Any paths rule, Detailed log disabled being written in JSON hits is the expected behavior; if the content is needed, the box is checked in the JSON common rule or in the related argument rule.

How it is done in the documentation

• Query · Detailed Log
• Event Logs · Attacks Tab
• SIEM & Attack Details · Attack Payload in WAF Info
• Request Body Limits · Max. Body Size to Log (kB)

Related questions

• Is the attack payload sent to the SIEM (Same as 'detailed log' / Always Send / Never Send)?
• How is a body that exceeds the Max. Body Size to Log(kB) limit written to the log; should I raise this limit?
• What do I see in a log record's details (Summary, Attacks, Request & Location)?