In a cluster, which device do WAF logs come from; how do I distinguish the device in Event Logs?

Short answer

Each device writes the records of only the requests that pass through itself to its own disk; records are not copied between devices. Event Logs pulls the records from the two devices together, combines them and sorts them by date. While Cluster is enabled, there is the Source column at the beginning of the table, and it shows with the device name which device the record came from; in a standalone (non-cluster) setup, this column does not exist. There is no device tab on the filter strip; records are separated by device by sorting the Source column. On the vService screen, since Line Limit is applied to each device separately, the combined list can exceed this number; Global WAF Event Log trims the combined result to the limit again. If a device cannot be reached, only the records of the other one are listed. On Dashboard, the device is separated with the Source selection in the settings (this device, the peer device or Both Devices; default Both Devices), and Live Stats shows each device in a separate column. WAF Report combines the records of the two devices; the scheduled report e-mail is sent only from device number 1 of the cluster.

Device Distinction by Screen

Screen	Data of the two devices	How is the device distinguished?
Event Logs	Combined list, sorted by date	Source column (only in a cluster); sorted by device by clicking the column header
Global WAF Event Log	Combined list, trimmed again to Line Limit	Source column
Dashboard	Default Both Devices: the total of the two devices	A single device is selected with Settings → Clustering → Source
Home → WAF	The total of the two devices	Settings → Source
Live Stats	Not totaled	Each device in a separate column, with the device name above the column
WAF Report	The records of the two devices combined	Not distinguished; if the peer device cannot be reached, the report is generated only with the local data
Notification Logs	Each device produces its own notifications	Source column
SIEM (Logs profile)	Each device sends its own lines from its own address	On the SIEM side, the source IP address of the device that sent the line

Points to Note

• The Source column shows from which device the row was read; when the active device changes (when the VIP moves to the peer device), the records are written on the other device from that moment on, and the old records stay on the first device.
• The retention period and manual deletion are applied on each device separately; a month deleted on one device stays on the other (How long are WAF logs kept?).
• WAF settings (mode, rule, notification, report) are sent to the peer device automatically with the default auto-sync; if Manual Sync Mode is on, they are sent to the peer device manually. The records, on the other hand, are not synchronized.

Common Misconceptions

• "Records are kept on both devices." Each device keeps the records of only the requests that pass through itself; Event Logs combines them while reading.
• "The number of rows in the list cannot exceed Line Limit." On the vService screen, since the limit is applied to each device separately, the combined list can exceed the limit.
• "If the peer device cannot be reached, the screen gives a warning." On the vService screen, the list comes only with the records of the reachable device; no separate warning is displayed.

How it is done in the documentation

• Event Logs · Under Which Condition Is the Log Produced?
• Event Logs · Scope and Limits
• Dashboard · Source
• HA Clustering & Sync · Manual Sync Mode

Related questions

• Which Event Logs columns are hidden by default; how do I show them?
• How long are WAF logs kept?
• Can I see the WAF logs of all vServices on one screen (Global WAF Event Log)?