How is a body that exceeds the Max. Body Size to Log(kB) limit written to the log; should I raise this limit?

Short answer

The body is either written entirely or not at all: if the body of a request that contains an attack fits into the Max. Body Size to Log(kB) limit, all of it is written to the Event Logs record, and if it exceeds the limit, none of it is written; no trimming is done, and if the value is 0, the body is never written. A body that is not parsed because it exceeded the processable size or did not complete in time is not written either. The limit manages only the request body in the record; the value caught by the signature (payload) is independent of it and is determined by the Detailed Log setting in the page type. When WAF is turned on, the value is 2 kB, and it cannot be greater than the Max. Body Size to Process(kB) value. On API vServices, it can be raised to see the full context; for bodies that carry passwords, cards or identity information, it is kept low or set to 0, because the written body goes into the log and the exports. The value is changed from the Request Body Limits window and saved with Edit.

Behavior

Body	Is it written to the Event Logs record
Fits into the limit and was parsed	Yes, all of it
Exceeds the limit	No
Not parsed (exceeded the processable size or did not complete)	No
Limit 0	Never

• Which records: The body is added only to the Event Logs record of requests in which an attack was found (blocked or monitored); the learning records are independent of this limit.
• Where it appears: Event Logs → record preview → Request & Location tab; details: Is the request body written to the log?
• Caught value (payload): What does the "Detailed Log" option do; is a log written if I turn it off?
• Card sentence: The Request Body Limits card shows the limit in the form At most 2 KB of the body is logged; while the value is 0, this line is not visible.

Should I Raise It?

For	Against
Full context in form and JSON attacks	A body is added to every attack record; the disk and export size grow
The whole body is seen in false positive analysis	Sensitive data such as passwords, cards and identity information go into the log
With a small limit, large bodies are not written at all	The value cannot exceed the Max. Body Size to Process(kB) value

Changing the Limit in TR7

1

Adım 1 Open the Request Body Limits window

In the Left Monitor Panel → WAF-Protected vServices → vService → WAF Management tab, the pencil icon at the top right of the Request body limits card in the Inspection & Blocking section is clicked.

2

Adım 2 Write the limit

0 or a number that does not exceed the Max. Body Size to Process(kB) value is written in the Max. Body Size to Log(kB) field (e.g. 16); if a greater value is written, the field gives an error and saving is not possible.

3

Adım 3 Save

Edit is clicked; the change is applied without a separate deployment step. In a cluster setup, it is also sent to the peer device with the default auto-sync; if Manual Sync Mode is on, it is sent to the peer device manually.

• WEB-CLI: waf options update poolId <vService> --syncWithDefaultFwRules false --bodyMaxLogSize 16 (body processing).

Common Misconceptions

• "The first 2 kB of a body that exceeds the limit is written." A body that exceeds the limit is not written at all.
• "This limit also cuts the caught payload." The payload is managed with the Detailed Log setting in the page type.
• "The limit makes the body of every request be written to the log." The body is added only to the record of requests in which an attack was found.

How it is done in the documentation

• Request Body Limits · Max. Body Size to Log (kB)
• Request Body Limits · The Request Body Limits Card on WAF Management
• Event Logs · Request & Location Tab

Related questions

• Is the request body written to the log?
• What does the "Detailed Log" option do; is a log written if I turn it off?
• What is the maximum value of Max. body size to process; how does it relate to the log limit?