What is the maximum value of Max. body size to process; how does it relate to the log limit?

Short answer

Max. Body Size to Process(kB) is an integer between 1 and 262144 kB (256 MB) and is 4096 kB when WAF is turned on. The size that can actually be processed is the greater of this value and the Buffer Size(kB) value in the vService limit profile. As the value grows, the buffer that can be allocated for each request grows and the memory consumption of the device increases; for pages that receive large uploads, instead of raising the limit on the whole vService, the Block Unparsed Contents and Raw Body Size settings on the Raw tab of that page type can be used. Max. Body Size to Log(kB) is 2 kB when WAF is turned on and cannot be entered greater than the Max. body size to process(kB) value; since an unparsed body is not written to the log anyway, the log limit cannot exceed the processing limit. The body is written to the log either entirely or not at all. The two values are changed from the Request Body Limits window and saved with Edit.

Body Limits

Limit	Value	What it does
Max. Body Size to Process(kB)	Integer 1–262144; 4096 when WAF is turned on	Upper limit of the body to be parsed; the actual limit is the greater of this value and the Buffer Size(kB) value
Max. Body Size to Log(kB)	0 or up to the processing limit; 2 when WAF is turned on	Upper limit of the body to be written to the attack record; either all of it or none (How is a body that exceeds the Max. Body Size to Log(kB) limit written to the log; should I raise this limit?)
Body in the learning record	Bodies smaller than 8 kB; cannot be set	Larger bodies are written to the learning record without the body content

• Body that exceeds the limit or is not completed: What happens to request bodies that exceed the Max. Body Size to Process(kB) limit or do not complete in time?
• Card sentences: The Request Body Limits card shows the lines The first 4 MB of the body is processed for inspection and At most 2 KB of the body is logged.
• Fail-open in the same window: In the Request Body Limits window, the Fail-open switch comes after the body fields; it is off when WAF is turned on. The switch is not related to the body size; it determines the fate of a request whose scan cannot be completed within the time limit. While it is off, this request is blocked in a host group in Blocking mode so that an uninspected request does not reach the Backend Service; while it is on, it is let through without being scanned. In the Learning and Monitor modes, these requests are let through anyway. Since a request that deliberately prolongs the scan can bypass WAF while the switch is on, the switch is turned on only if these blocks affect the service; the setting that determines the amount of body scanned is Max. body size to process(kB). The switch is vService-wide and affects all host groups in Blocking mode; it does not appear in the card sentences, its state is seen in the window. WEB-CLI: waf options update poolId <vService> --syncWithDefaultFwRules false --failOpen true. Details: What happens to a request if the scan exceeds a certain time (2-second scan limit)?
• Performance: How do large request bodies (file uploads) affect WAF performance?
• File upload problems: File uploads are being blocked by the WAF; how do I fix it?
• Scope: The setting applies across the vService and is common to all host groups.

Changing the Limits in TR7

1

Adım 1 Open the Request Body Limits window

In the Left Monitor Panel → WAF-Protected vServices → vService → WAF Management tab, the pencil icon at the top right of the Request body limits card in the Inspection & Blocking section is clicked.

2

Adım 2 Write the processing limit

An integer between 1 and 262144 is written in the Max. Body Size to Process(kB) field; its equivalent (e.g. 8 MB) appears next to the field.

3

Adım 3 Write the log limit

0 or a value that does not exceed the processing limit is written in the Max. Body Size to Log(kB) field; if a greater value is written, the field gives an error and the save cannot be made.

4

Adım 4 Save

Edit is clicked; the change is applied without a separate deployment step, but if the Max. Body Size to Process(kB) change modifies the buffer size (when the new or the old value is greater than the Buffer Size(kB) value), the vService is restarted during saving and a short interruption occurs. In a cluster setup, it is also sent to the peer device with the default auto-sync; if Manual Sync Mode is on, it is sent to the peer device manually.

• WEB-CLI: waf options update poolId <vService> --syncWithDefaultFwRules false --bodyParseLimit 8192 --bodyMaxLogSize 16 (body processing).

Common Misconceptions

• "Raising it to 256 MB has no cost." As the value grows, the buffer that can be allocated per request and the memory consumption of the device increase.
• "When the log limit is raised, large bodies are logged." The log limit cannot exceed the processing limit, and an unparsed body is never written to the log in any case.
• "The first part of a body that exceeds the limit is processed." The body is either parsed entirely or not at all.

How it is done in the documentation

• Request Body Limits · Max. Body Size to Process (kB)
• Request Body Limits · Max. Body Size to Log (kB)
• vService Limits · Buffer Size(kB)

Related questions

• What happens to request bodies that exceed the Max. Body Size to Process(kB) limit or do not complete in time?
• How is a body that exceeds the Max. Body Size to Log(kB) limit written to the log; should I raise this limit?
• How do large request bodies (file uploads) affect WAF performance?