Smarter by Design.Simpler for Business
TR7Enterprise Application Delivery & Security Platform
Where do I see the WAF notifications that were sent (Notification Logs)?
Short answer
In three places. All the notifications on the device are listed on the Notification Logs screen opened via Settings → System Logs → Notification Logs; the WAF records carry the names WAF Attack Rate (per-second thresholds), Advanced WAF Notification (advanced triggers) and WAF Rule Compilation. The WAF notifications of a single vService are seen, filtered to that vService only, on the Notification Log tab opened with the Notification Log link of the Notifications card in WAF Management. The recent notifications also appear in the notification panel at the bottom right. The list contains the name, the date and the text of the notification (e.g. WAF block rate is high for vService "web": 28/s > 20/s) and the e-mail and SMS delivery result; in a cluster setup, the Source column shows which device the notification came from. Time Range is the last 24 hours by default. The record is written even if UI Notification is off.
Problem: Whether the Notification Was Sent Is to Be Verified
The aim is to check whether the notification was produced when the threshold was exceeded, which recipients it was delivered to and whether the e-mail or SMS sending succeeded. Whatever the notification channel, every WAF notification is written to the Notification Logs record.
Solution: Three Methods
| Your situation | Suitable method |
|---|---|
| The WAF notifications of a single vService | Method 1: Notification Log on the Notifications card |
| All the notifications on the device, filtering and exporting | Method 2: Notification Logs screen |
| A quick look at the recent notifications | Method 3: Notification panel |
Method 1: Notification Log on the Notifications Card Recommended
- How it works The Notification Log link in the bottom strip of the card opens a closable Notification Log tab on the same screen; the tab limits the Notification Logs list to the WAF notifications of this vService. The link is also present while the card is Disabled.
- Where it is opened On the vService screen, WAF Management → Learning & Reporting → Notifications card → Notification Log
- Requirement WAF permission
- vService type HTTP
Step-by-Step Configuration
1
Adım 1 Open the WAF Management tab
The Left Monitor Panel → WAF-Protected vServices → vService → WAF Management tab is opened.
2
Adım 2 Open the Notification Log tab
The Notification Log link in the bottom strip of the Notifications card is clicked; the Notification Log tab opens and the records of the last 24 hours are listed.
3
Adım 3 Change the range (if needed)
A new range is selected from the time range selector on the toolbar.
4
Adım 4 Refresh the list
Get Logs is clicked; the list does not refresh on its own.
Verification
1RecordTR7 side
The name and the text in the list are read.
Expected
WAF Attack Rate · WAF block rate is high for vService "web": 28/s > 20/sMethod 2: Notification Logs Screen
- How it worksNotification Logs keeps all the notifications of the device; the records are persistent and cannot be deleted from the screen.
- Where it is openedSettings → System Logs → Notification Logs
- Requirement Permission to access the Settings screen
- Scope Device-wide; the notifications of all vServices and all products
Step-by-Step Configuration
1
Adım 1 Open the screen
The Settings → System Logs → Notification Logs steps are followed (listing screen).
2
Adım 2 Select the time range
Time Range is selected (default the last 24 hours).
3
Adım 3 Get the logs
Get Logs is clicked.
4
Adım 4 Filter the WAF notifications
Filter is opened; in the Notification Name filter, WAF Attack Rate and Advanced WAF Notification are selected. With the Type filter, only the Alarming, Info or OK records are shown.
5
Adım 5 Export (if needed)
The list is downloaded as Excel, CSV or PDF with Export.
| Column | Content |
|---|---|
| Notification Name | The name of the notification; the icon at the beginning of the row is red for Alarming, dark for Info and green for OK; the Go to Related Page icon next to it leads to the related screen |
| Date | The date of the notification |
| Text | The text of the notification; the back to normal text shows that the alarm has closed |
| Notification Contacts | E-mail and SMS delivery: a green symbol if successful, a red symbol if unsuccessful; interface and SNMP delivery are not listed (delivery channels) |
| Source | Only in a cluster; the device that produced the notification |
Verification
1Filtered listTR7 side
After the filter is applied, the list is examined.
Expected
Only WAF Attack Rate and Advanced WAF Notification recordsMethod 3: Notification Panel
- How it works The notification panel at the bottom right shows the recent notifications instantly; only the WAF notifications for which UI Notification is on appear here.
- Where it is opened The message symbol of the status bar in the bottom right corner of the screen
- RequirementUI Notification on in the WAF notification
- Scope Recent notifications
Step-by-Step Configuration
1
Adım 1 Open the panel
The message symbol at the bottom right is clicked; the recent notifications are listed (notification panel).
2
Adım 2 Show only the alarms (if needed)
Show Only Alarm Notifications is checked; for the full list, Go to Notification Logs is clicked.
Verification
1PanelTR7 side
The recent records in the panel are examined.
Expected
WAF block rate is high for vService …Common Mistakes
- Looking for the notification in the panel while UI Notification is off. The record is written to Notification Logs and does not appear in the panel (What are the notification channels (UI, e-mail, SMS, SNMP)?).
- Expecting the list to refresh on its own. For new records, Get Logs is clicked again.
- Thinking that the profiles in Notification Management are the WAF thresholds. The WAF thresholds are defined in the Notifications window of the vService.
- Looking at the records of a single device in a cluster. Each device produces notifications with its own traffic; the records of the two devices are told apart with the Source column.
How it is done in the documentation
