What are Event Logs; which requests are logged?

Short answer

Event Logs is the log screen on which the requests in which the WAF found an attack on a WAF-protected vService are examined one by one: each row carries the date, the decision (Action), the client IP, the method, the path and the attack count; in the preview of the row, the triggered signatures and their classifications, the headers, the body if it was recorded, and the attacker's network and location are visible. From the same screen, a false positive is taught with Allow / Teach and the source address is blacklisted. A row is written in two cases: if the total attack score of the request reached the blocking threshold (whether the request is blocked, or passed in Monitor mode or because it was recognized by Teacher) or if it stayed below the threshold and triggered a signature in Monitor state. Clean requests, other matches that stay below the threshold, requests that belong to a host group in Learning mode and to Conditional Learning sources, requests that never enter WAF inspection and requests whose scan times out are not written to Event Logs.

Which Requests Are Logged?

Request	Is it written to Event Logs?	Action tooltip
Score reached the threshold, host group in Blocking Mode	Yes	Attack blocked
Score reached the threshold, host group in Monitor Mode	Yes	Not blocked — Monitor mode
The request came from a Teacher source; its score reached the threshold or it triggered a signature in Monitor state	Yes	With the name of the Teacher source that recognized the request: Not blocked — Teacher IP matched, Not blocked — Teacher cookie matched or Not blocked — Teacher header matched
Score stayed below the threshold but triggered a signature in Monitor state	Yes	Not blocked — Below the blocking threshold (Not blocked — Monitor mode if the host group is in Monitor mode)
Score stayed below the threshold, no signature in Monitor state	No	-
Host group in Learning Mode or the request came from a Conditional Learning source	No; the request is written to the learning log	-
A request that matches the Whitelist Condition or is within the scope of Do not WAF static contents	No; WAF inspection is not performed	-
A request whose scan cannot be completed within the time limit	No; in Blocking mode, the request is blocked (if Fail-open is on, it is passed without being scanned); in Learning or Monitor mode and in a request that comes from a Teacher or Conditional Learning source, it is passed (if the scan was cut off while the rules were being loaded and before the host group was determined, and the vService has a group in Blocking mode, a request that comes to a group in Learning or Monitor mode is also blocked). The blocked request appears as Attack blocked — scan timed out in Debug Mode Logs while the vService is in Debug mode (Why does a request that received 418 not appear in Event Logs?)	-

• A row that matches the WAF Log Suppression Condition continues to be written to disk but is not shown in the list (How do I stop WAF logs of Health Check or probe traffic (WAF Log Suppression Condition)?).
• Details of the relationship between the mode and the record: In which mode is an Event Logs record created and in which is it not; are attacks below the threshold also logged? · Decision dictionary: Which decisions does the WAF make for a request; what do Action in Event Logs and Verdict in Debug Mode Logs mean?

What Is on the Screen?

Section	Content
Table	Default columns Date, Action, Client IP, Method, Path, Attacks, User Agent; hidden columns Severity, Host, Category, Scopes, ASN Org, X-Forwarded-For
Server filter	Date Range (default last 7 days), Line Limit (default 1,000), Request Unique ID, Log Filter
Filter strip	Tabs that narrow the fetched records by fields such as IP, country, path, signature, category and OWASP
Preview	Summary, Attacks, Request & Location tabs (What do I see in a log record's details (Summary, Attacks, Request & Location)?)

The screen is opened via Left Monitor Panel → WAF-Protected vServices → vService → Event Logs and requires WAF permission. The list does not refresh on its own; it is fetched again with Refresh or when the server filter is changed. Event Logs is produced only on HTTP vServices (supported vService types).

Keeping the Records

• The records are written to one file per vService per hour; files older than two hours are compressed and are decompressed when they are read. The retention period depends on the Disk Management rules (How long are WAF logs kept?).
• In a cluster setup, each device keeps the records of the requests that pass through it; the screen combines the records of the two devices and shows the source in the Source column.
• Event Logs is an attack log; the learning log is kept separately and is read by Analysis & Learning (What is the learning log; where is it kept?).

Common Misconceptions

• "Every signature match is logged." Requests whose total score stays below the blocking threshold and that do not trigger a signature in Monitor state are not written to Event Logs.
• "Attacks in Learning mode appear in Event Logs." In Learning mode and in Conditional Learning sources, requests are written to the learning log; Event Logs stays empty.
• "Every row in Event Logs is a blocked request." Requests in Monitor mode, requests recognized by Teacher, and requests that stay below the threshold and trigger a signature in Monitor state are also written; the decision is shown in the Action column.
• "The suppression condition stops the writing to disk." WAF Log Suppression Condition only hides from the list.

How it is done in the documentation

• Event Logs · What Is Event Logs?
• Event Logs · Under Which Condition Is the Log Produced?
• Event Logs · The Action Values

Related questions

• In which mode is an Event Logs record created and in which is it not; are attacks below the threshold also logged?
• In which cases is a request not blocked even though an attack is detected (signature in Monitor state, Monitor mode, Teacher, Learning mode)?
• How do I see the list of blocked requests?