Where do I see the change history of WAF settings?

Short answer

In two places. Device-wide, on the Settings → System Logs → User Logs screen, WAF is selected from the Field filter; additions, edits and deletions in the WAF settings, in host groups (Virtual Host Groups), in page types and in Check Fields, Merge, Import and Export, returning to the default, OWASP Rules and Signature & Rule Library changes, and the applied learnings are listed with the who, when and from where information (User Logs); the Changes tab of the record shows the old and new values field by field. This screen is open only to users who see the Settings menu (among the built-in roles, Admin and Read-only user). For a single vService, in WAF-Protected vServices, the Log tab in the WAF - WAAP Data Flow Panel on the right of the vService's Dashboard or WAF Management tab gives the WAF records of that vService as a timeline; Revert Learning under the learning records is located here. Admin sees all records, roles with full permission in the WAF area see all WAF records, and other users see only their own records. The Enable and Disable operations in the WAF-Protected vService List are not written to the user log.

Problem: It Is Not Known Who Changed the WAF Setting

On a vService, the protection level, the host group mode or the page types have changed; who made the change, when and with which values needs to be found.

What Is Logged?

WAF writes made from the interface, from WEB-CLI or from the API are logged as Field = WAF; in records originating from WEB-CLI, @web-console is added to the User-agent cell, and in those originating from SSH, @ssh is added.

Logged operation	Action type	In the vService Log tab
WAF settings (editing the cards, waf options update)	Edit	Visible
Adding, editing (including the mode) and deleting a host group	Creation · Edit · Deletion	Visible
Adding, editing and deleting page types and Check fields; Merge	Creation · Edit · Deletion · Merge	Visible
Page types Export and Import (including the OpenAPI formats)	Export · Import	Visible
Returning the rules to the default, adding the default header rules	Edit · Creation	Visible
Learnings applied with Allow / Teach, Teacher, AI learning and Learn selected, and undoing them	Edit	Visible; with Revert learning below it
OWASP rules changes of the vService	Creation · Edit · Deletion	Visible
Signature & Rule Library (device-wide layer) changes and the Global WAF Report setting	Creation · Edit · Deletion	Not visible; only User Logs

For changes made with bulk commands (update-many, reset-rules, add-arg-headers), a separate record is written for each target, and the text of the record shows the position of that target within the bulk operation.

Not logged:

• Enable / Disable in the WAF-Protected vService List. These operations are not written to the user log. If WAF protection is turned on or off with the WAF box in the vService form or with lb service update id <vService> --waf true, it is logged as a vService edit under Field = Traffic manager.
• Applying the Analysis & Learning result. Applying the analysis with Apply does not produce a user log record; therefore it does not appear in the Log tab and cannot be undone with Revert learning (applying the analysis result).
• Exporting WAF rules from a backup. Export WAF Rules in Backup & Restore prepares the file in the browser; no record is created.

Solution: Three Methods

User Logs is used for a device-wide search, the Log tab of the vService for the history of a single vService, and the learning history views for the details of automatic learnings; the three can be used together.

Your situation	Suitable method
Device-wide search by user or by operation (Admin or Read-only user)	Method 1: User Logs
The WAF changes of a single vService; access with WAF roles	Method 2: The vService's Log tab
Evidence of the learnings applied by AI learning or Teacher	Method 3: Learning history views

Method 1: User Logs Recommended

• How it worksUser Logs records every user operation with the user, the time, the source and a field-based diff; WAF operations are filtered with Field = WAF. In a cluster setup, the records of both devices are listed together; the Source column shows the device on which the operation was performed.
• Where it is opened Configuration Menu → Settings → System Logs → User Logs
• Requirement View permission for the Settings menu (among the built-in roles, Admin and Read-only user). Admin sees all records; Read-only user sees only its own records.
• Scope All WAF operations on the device

Step-by-Step Configuration

1

Adım 1 Open the screen

Configuration Menu → Settings → System Logs → User Logs is opened.

2

Adım 2 Select the time range

The range is selected in the Time Range field; the default is the last 7 days.

3

Adım 3 Get logs

The Get Logs button is clicked. The list does not refresh on its own; for new records, the button is used again (Get Logs).

4

Adım 4 Filter the WAF records

In the Filter panel, Field = WAF is selected; if needed, the list is narrowed with Action Type (Creation, Edit, Deletion, Import, Export, Merge), Object or Username.

5

Adım 5 Read the difference

The row is clicked; in the Changes tab of the preview, the added (+), deleted (−) and modified (•) values are seen field by field. General use of the records: Can I see who made changes and when?

Verification

1New recordTR7 side

A small change is made in one of the WAF cards of a vService and the list is refreshed with Get Logs.

ExpectedWAF settings edited for + vService name

Method 2: The vService's Log Tab

• How it works The Log tab of the WAF - WAAP Data Flow Panel on the right of the Dashboard and WAF Management tabs shows the WAF records of that vService as a timeline. Under the applied learning records, there is a Revert learning link (Can I revert a learned rule?).
• Where it is opened Left Monitor Panel → WAF-Protected vServices → vService → Dashboard or WAF Management tab → WAF - WAAP Data Flow Panel on the right → Log
• Requirement WAF permission. Admin and the roles with full permission in the WAF area (WAF manager, Traffic+WAF manager) see all WAF records; other roles see only their own records. Revert Learning requires full permission in the WAF area.
• Scope Single vService

Step-by-Step Configuration

1

Adım 1 Open the vService

In the Left Monitor Panel, the vService is clicked in the WAF-Protected vServices category; the screen opens with the Dashboard tab that carries the name of the vService (accessing the screen).

2

Adım 2 Open the Log tab

The Log tab in the panel on the right is clicked. If the panel is collapsed, it is opened with the handle on its left edge; the panel appears only on the Dashboard and WAF Management tabs.

3

Adım 3 Set the range and the limit

By default, the last 10 records of the last 3 years are fetched. For more records, the date range and Log Limit are increased on the toolbar of the tab; the settings are stored per user. Refresh, Excel and CSV export, and the full-screen log view are on the same toolbar.

4

Adım 4 Read the difference

By hovering over the Changes (N) mark of a record, the old and new values are read field by field. In learning records, which check of which path was learned and the clients the learning is based on are written.

Log in the WAF-Protected vService List preview

On the Configuration Menu → WAF → WAF-Protected vService List screen, the Log tab of the preview that opens when a row is clicked lists the Load Balancer records of the vService; WAF records do not appear here. For WAF changes, the path above is used.

Verification

1Log tabTR7 side

The mode of a host group is changed and the refresh icon in the Log tab is clicked.

ExpectedThe host group edit record at the top, with Changes (1)

Method 3: Learning History Views

• How it works The learnings applied by AI learning and Teacher are listed with the date, the path, the location and the evidence (AI Learning History, Teacher History).
• Where it is opened Left Monitor Panel → WAF-Protected vServices → vService → AI Learning & Teacher Tracking tab
• Requirement WAF permission; AI Learning or Teacher on in the vService (if both are off, the tab does not appear)
• Scope Single vService, automatic learnings only

Step-by-Step Configuration

1

Adım 1 Open the tracking tab

On the vService screen, the learning tracking tab is clicked; depending on the enabled method, the name of the tab is AI Learning Tracking, Teacher Tracking or AI Learning & Teacher Tracking (Why is the AI Learning & Teacher Tracking tab not visible?).

2

Adım 2 Select the history view

In the view selector, AI Learning History or Teacher History is selected (views); the date range is set.

3

Adım 3 Examine the record

The row is clicked; in the preview, the number of requests and the clients the learning is based on are seen. Details: How do I see what AI Learning and Teacher applied in the past?

Verification

1MatchTR7 side

The date of a learning in the history view is searched for in the Log tab in Method 2.

ExpectedA learning record for the same path at the same time

Common Mistakes

• Looking for an Enable and Disable record. These operations in the WAF-Protected vService List are not written to the user log; a change made with the WAF box in the vService form appears under Field = Traffic manager.
• Looking for WAF changes in the Log tab of the WAF-Protected vService List preview. That tab shows Load Balancer records; WAF records are in the right panel of the Dashboard or WAF Management tab.
• Looking for device-wide signature changes in the Log tab of the vService. Since Signature & Rule Library changes are not bound to a vService, they appear only in User Logs.
• Looking for the User Logs screen with WAF manager. The Settings menu does not appear in this role; WAF manager sees all of the WAF records in the Log tab of the vServices.
• Trying to undo applying Analysis & Learning with Revert learning. Applying the analysis does not produce a user log record, so there is no revert link either; to go back, the Export file taken beforehand is imported (Can I back up my WAF rules?).
• Leaving Time Range at the default. User Logs fetches the last 7 days by default; for older changes, the range is widened.

How it is done in the documentation

• User Logs · What Is Logged?
• User Logs · Filter
• User Logs · Preview of the Selected Log Record
• Dashboard · Panel Tabs
• AI Learning & Teacher Tracking · Reverting the Learning

Related questions

• Can I see who made changes and when?
• How do I see the change history of a single vService or Backend Service?
• How do I see what AI Learning and Teacher applied in the past?
• Can I revert a learned rule?