What is the learning log; where is it kept?

Short answer

The Learning Log is the structural record of the requests that come to a host group in Learning mode or that carry a Conditional Learning identity: date, source and destination address, host, path, method, Content-Type, User-Agent, raw query and headers, body length, parsable body below 8 KB, the name, size and type of multipart files (not their content), matching signatures and response code. The row is written in the response stage; while Smart Sampling is on, repetitions of the same shape are thinned out. The records are kept on the device in hourly files per vService, are compressed later and are read by Analysis & Learning. It is not to be confused with Event Logs: in Learning mode, no Event Logs record is created; in a group in Monitor and Blocking mode, Teacher requests are not written to the learning log; of these, the requests that reach the blocking threshold or trigger a signature in Monitor state are written to Event Logs. There is no separate retention setting: the Auto Disk Cleanup rules in Disk Management delete the learning log files together with the WAF logs, on a monthly basis. There is no screen that shows the raw rows; the record is seen through the Analysis & Learning results and the Learning tab of the Dashboard.

Learning Log and Event Logs

	Learning log	Event Logs
When it is written	A group in Learning mode or a Conditional Learning identity; requests that fall within the scope of Whitelist Condition or Do not WAF static contents are not written, since they do not enter the WAF inspection	Requests that reach the blocking threshold or trigger a signature in Monitor state in Monitor and Blocking mode (In which mode is an Event Logs record created and in which is it not; are attacks below the threshold also logged?)
Who reads it	Analysis & Learning	AI Learning, Teacher, Allow / Teach, administrator
Viewing in the interface	No raw row screen	Event Logs tab
Volume management	Smart Sampling (What is Smart Sampling; how does it affect the learning log?)	None; WAF Log Suppression Condition does not delete the record, it only removes it from the list and from what AI learning and Teacher read
Deletion	Auto Disk Cleanup (How long are WAF logs kept?)	Auto Disk Cleanup

Retention

• The files are hourly; the file of an hour is compressed approximately one hour after that hour ends. While an analysis is running on that vService, the compression waits.
• Auto Disk Cleanup runs every day and applies two rules: when the disk usage exceeds the % limit for auto disk cleanup value (default 90; 70–95), it deletes starting from the oldest months, and it deletes the months older than the Month Limit for Auto Disk Cleanup value (default 12). There is no separate protection or duration for the learning log.
• On the Disk Management screen, the learning log files appear on a monthly basis with the Learning file type and can be deleted manually.
• The records of the period to be analyzed may have been deleted because of these rules; if a long-term analysis is planned, the disk rules are set accordingly.
• Managing the volume in terms of disk and CPU: How are the disk and CPU load of the learning log kept under control (Smart Sampling)?

Common Misconceptions

• "Attacks in Learning mode are seen in Event Logs." They are written to the learning log; Event Logs stays empty.
• "Teacher traffic is written to the learning log." In a group in Monitor and Blocking mode, Teacher requests do not enter the learning log; Teacher requests that reach the blocking threshold or trigger a signature in Monitor state are written to Event Logs without being blocked, with the Teacher decision. Only Teacher requests that fall into a group in Learning mode enter the learning log.
• "The learning log is never deleted." The Auto Disk Cleanup rules delete the learning log files as well.
• "WAF log suppression condition shrinks the learning log." WAF Log Suppression Condition does not touch the learning log; it is applied only to Event Logs records.

How it is done in the documentation

• WAF · Terminology
• Analysis & Learning · What Is Analysis & Learning?
• Log Settings · Smart Sampling (Learning Log)
• Disk Management · Auto Disk Cleanup

Related questions

• In which mode is an Event Logs record created and in which is it not; are attacks below the threshold also logged?
• How are the disk and CPU load of the learning log kept under control (Smart Sampling)?
• What is Smart Sampling; how does it affect the learning log?