Can I see the WAF logs of all vServices on one screen (Global WAF Event Log)?

Short answer

Yes. The Global WAF Event Log screen, opened through WAF → Global WAF Event Log, collects the Event Logs records of all WAF-protected vServices in a single table. The columns, filters and preview are the same as on the vService's Event Logs screen; the differences are the vService column at the beginning of the table (when the name is clicked, the WAF screen of that vService opens), the vService tab on the filter strip, the vService field in the server filter that narrows the scan (All vServices or Pick vServices) and the default Line Limit of 5,000 rows. The scan proceeds from the newest record to the oldest and stops when the row limit is filled; if the time was not enough, the Results are complete back to … warning is displayed above the list. The screen requires the WAF permission and is not shown in the menu for accounts whose permission is restricted to specific vServices.

Problem: The Records Are on Separate Screens per vService

The Event Logs screen of each vService shows only the records of that vService. To see that the same source is trying more than one application, to find a record when only the request ID on the blocking page is at hand, or to measure the effect of a signature across all applications, the screens have to be visited one by one.

Solution

Global WAF Event Log

• How it worksGlobal WAF Event Log scans the selected time range from the newest to the oldest in slices (the first slice is one hour, doubling in every round up to at most 24 hours); it stops when the Line Limit is filled or the time budget runs out.
• Where it is openedWAF → Global WAF Event Log
• Requirement WAF permission; an account whose permission is not restricted to specific vServices (how to access)
• vService type HTTP (only the vServices with the WAF box checked are scanned)

Step-by-Step Configuration

1

Adım 1 Open the screen

The Configuration Menu is opened with the TR7 logo at the bottom left and WAF → Global WAF Event Log is selected. The list is fetched automatically with the last used scope (on the first opening, the last 7 days and 5,000 rows).

2

Adım 2 Open the server filter tab

The fixed tab at the beginning of the filter strip is clicked; the tab contains the Date Range, Line Limit, Request Unique ID, vService and Log Filter fields (determining the scan scope).

3

Adım 3 Select the vServices to scan (if needed)

The vService field scans all WAF-protected vServices with the default All vServices. If the affected vServices are known, the switch is set to the Pick vServices position and the vServices are selected; the log files of the vServices that are not selected are not opened at all, and the whole row limit is spent on the selected ones.

4

Adım 4 Set the time range and the row limit

Date Range is kept narrow; Line Limit is entered between 1 and 20,000 (default 5,000). On this screen, the row limit is also the stopping condition of the scan; enlarging the limit lengthens the scan.

5

Adım 5 Save and list

Save & Get Logs is clicked.

After the list is fetched, the records are narrowed with the vService tab on the filter strip and with tabs such as Client IP, ASN, Country and Signature; the vService tab in the strip does not filter the scan, only the fetched rows. Rows belonging to different vServices can be selected together and taught with Allow / Teach; the operation is written separately to the own rule set of each vService (operations).

Verification

1ListTR7 side

The vService column at the beginning of the table and the information strip above the list are examined.

ExpectedRows belonging to different vServices; no strip, or Results are complete back to …

If the strip appears, the list is complete back to the date written; for older records, Date Range is narrowed and the scan is run again.

Common Mistakes

• Starting the search with a wide time range. The scan is limited by a time budget; if the range is wide, the list stays partial and the Results are complete back to … warning is displayed. The search is deepened by narrowing the range.
• Concluding "there is no record" without looking at the scope warning. If there is a warning, the record searched for may be in an older slice that was not scanned (partial result).
• Trying to narrow the scan with the vService tab on the filter strip. The strip filters only the fetched rows; the scan is narrowed by the vService field in the server filter.
• Starting many global scans at the same time. At most two global scans run at the same time; this quota is shared with Global WAF Report generation and the device-wide Bot/DDoS log scanning. The third request gets the Another global scan is running right now — please try again shortly warning.
• Looking for the screen with a vService-restricted account. It is not shown in the menu for accounts whose permission is restricted to specific vServices; these accounts use the Event Logs screen of their own vServices.
• Using this screen for a periodic total. The list is cut short by the row limit; for the total and the breakdown of the period, a Global WAF Report is generated (Can I get a single WAF report for the whole device (Global WAF Report)?).

How it is done in the documentation

• Global WAF Event Log · What Is Global WAF Event Log?
• Global WAF Event Log · The Determination of the Scanning Scope
• Global WAF Event Log · The Working of the Scanning
• Global WAF Event Log · Operational Best Practices

Related questions

• How do I find a specific request by its Request Unique ID?
• Can I get a single WAF report for the whole device (Global WAF Report)?
• How do I fix the same false positive on several vServices at once (global layer)?
• Can I see the Bot/DDoS events of all vServices on one screen (Global Event Log)?