Smarter by Design.Simpler for Business
TR7Enterprise Application Delivery & Security Platform
How are the disk and CPU load of the learning log kept under control (Smart Sampling)?
Short answer
The Learning Log is written only for the traffic within the learning scope, that is, for the requests that come to the host groups in Learning mode or that carry a Conditional Learning identity, and at the response stage; if no group is in Learning mode and the Conditional Learning switch is off, the writing does not run at all. The number of lines written is managed by Smart Sampling (learning log) on the Log Settings card: it is on by default, writes the first 50 samples of each request shape (Sampling: Full Copies per Shape) in full, and from the rest writes approximately one in twenty; a line that is not written never goes to the disk. The share of the written and skipped lines is seen in the Learning Log Sampling panel (Written, Skipped) on the Learning tab of the Dashboard. When the learning is complete, moving the host groups to Monitor or Blocking and turning off Conditional Learning stops the writing completely; when Conditional Learning is turned off, the identity fields are first emptied and saved, and the switch is turned off after that with a separate save. The files are deleted on a monthly basis by the Auto Disk Cleanup rules in Disk Management. WAF Log Suppression Condition does not affect the learning log.
Problem: The Learning Log Consumes Disk and CPU
On a busy site in Learning mode, the learning log grows quickly. The write volume needs to be reduced or, if the learning is finished, the writing needs to be stopped completely.
Solution: Three Methods
| Your situation | Suitable method |
|---|---|
| The learning is in progress; I want to reduce the number of lines written | Method 1: Log Settings |
| The learning is finished; I want to stop the writing completely | Method 2: Removing the learning scope |
| I want to make the sampling setting with a command | Method 3: WEB-CLI |
Method 1: Log Settings Recommended
- How it works Sampling is kept on and the number of samples written in full per shape is set; the sampling frequency after the quota changes together with this number.
- Where it is opened Left Monitor Panel → WAF-Protected vServices → vService → WAF Management → Learning & Reporting → Log Settings card
- Requirement Modify permission in the WAF area
- vService type HTTP
Step-by-Step Configuration
1
Adım 1 Open the Log Settings window
In the Left Monitor Panel → WAF-Protected vServices → vService → WAF Management tab, the pencil icon of the Log Settings card in the Learning & Reporting section is clicked; the Log Settings window opens (Log Settings Edit screen).
2
Adım 2 Set the sampling
Smart Sampling (learning log) is left checked; Sampling: Full Copies per Shape (5–10000, default 50) is lowered if needed. As the value is lowered, the sampling after the quota also becomes sparser (most sparsely one in 100). The meaning of the value: What is Smart Sampling; how does it affect the learning log?
3
Adım 3 Save
Edit is clicked; there is no separate deployment step. In a cluster, the setting goes to the peer device with the default auto-sync; if Manual Sync Mode is on, it is sent manually.
Verification
1CardTR7 side
The sentence on the Log Settings card is examined.
Expected
The learning log is smart-sampled — the first N of each request shape are written in full2PanelTR7 side
The Learning Log Sampling panel on the Learning tab of the Dashboard is examined.
Expected
The Skipped share increasesMethod 2: Removing the Learning Scope
- How it works When no group remains in Learning mode and no Conditional Learning remains on, the writing of the learning log stops completely.
- Where it is opened WAF Management → the mode card of the host group (WAF Mode) · Learning Methods card
- Requirement Modify permission in the WAF area · the learning having been completed and the analysis having been applied
- vService type HTTP
Step-by-Step Configuration
1
Adım 1 Open the WAF Management tab of the vService
In the Left Monitor Panel, the WAF-Protected vServices category is selected, the vService is clicked and the WAF Management tab is opened.
2
Adım 2 Open the edit window of the mode card
On the mode card of the host group in Learning mode, Edit at the bottom right corner of the title strip is clicked; the window titled Edit opens.
3
Adım 3 Select the mode
In the WAF Mode field, Monitor Mode or Blocking Mode is selected (When should I move from Learning to Monitor and from Monitor to Blocking?).
4
Adım 4 Save the mode change
The Edit button in the window is clicked. If there is another host group in Learning mode, steps 2–4 are repeated for each group. If Conditional Learning is off, the configuration ends here.
5
Adım 5 Open the Learning Methods window
The pencil icon of the Learning Methods card in the Learning & Reporting section is clicked.
6
Adım 6 Clear the identity fields
The Conditional Learning IP, Conditional Learning Cookie and Conditional Learning Header fields are emptied. When the switch is turned off, these fields are hidden from the form and a change in the hidden fields is not saved; the saved identities also continue to match. For this reason, the fields are emptied with a separate save before the switch is turned off.
7
Adım 7 Save the clearing
The Edit button in the window is clicked.
8
Adım 8 Open the Learning Methods window again
The pencil icon of the Learning Methods card is clicked again.
9
Adım 9 Turn off Conditional Learning
The Conditional Learning switch is turned off.
10
Adım 10 Save
The Edit button in the window is clicked. In a cluster, the changes go to the peer device with the default auto-sync; if Manual Sync Mode is on, they are sent manually.
Verification
1DashboardTR7 side
The Dashboard tabs are examined.
Expected
The Learning tab is not visibleThe Learning tab is visible only while there is a group in Learning mode or Conditional Learning is on.
Method 3: WEB-CLI
- How it works The sampling fields are written with the
waf options updatecommand. - Where it is openedWEB-CLI →
waf options update - Requirement WEB-CLI access · modify permission in the WAF area
- vService type HTTP
Step-by-Step Configuration
1
Adım 1 Set the sampling
--smartSampling turns on the sampling, --smartSamplingCopies is the number of full copies per shape (5–10000). --syncWithDefaultFwRules is not a stored setting but a write trigger: only when true is written is the Any Paths rule rebuilt with its default definition; if it is not written in the command, the rule set is not touched. The false in the command states this explicitly (Sync with Default WAF Rules):
text
waf options update poolId <vService> --syncWithDefaultFwRules false --smartSampling true --smartSamplingCopies 20Verification
1CardTR7 side
The sentence on the Log Settings card is examined.
Expected
the first 20 of each request shape are written in fullCommon Mistakes
- Turning off the sampling. Every request is written in full; it is suitable only on low traffic and the Learning tab is not visible.
- Trying to reduce the learning log with the WAF log suppression condition. WAF Log Suppression Condition does not touch the learning log; it is applied only to the Event Logs records (How do I stop WAF logs of Health Check or probe traffic (WAF Log Suppression Condition)?).
- Leaving the groups in Learning mode even though the learning is finished. The writing continues and the group remains unprotected (in Learning mode, requests are not blocked by a WAF decision).
- Turning off Conditional Learning while the identity fields still contain values. Even while the Conditional Learning switch is off, the requests that come with a saved identity continue to be processed without being blocked; first the fields are emptied and saved, and the switch is turned off after that with a separate save (Method 2).
- Managing the disk only with sampling. Old files are deleted by the Auto Disk Cleanup rules; the values of the rules are checked in Disk Management (What is the learning log; where is it kept?).
How it is done in the documentation
