What is Recompile and when is it needed?

Short answer

Before the patterns in the library are used in the traffic, they are compiled on each device and turned into a signature database, and this compilation is managed automatically: state, score and scope changes do not require compilation; a new custom rule or a pattern change has only the affected rule set (the global one or that of the relevant vService) compiled (Recompiling of the Signature Database). The Recompile button, outside this mechanism, produces the whole database from scratch; it is not needed in daily management. It is used after a compilation error is resolved, when the integrity of the database is suspected, or when the WAF rules are not loaded, traffic is not being inspected: the compiled rule database was built for a different processor type and has to be recompiled on this machine warning is seen in the vService status. The button is on the toolbar of Signature & Rule Library and of the vService's OWASP Rules screen, and on both screens it produces the whole signature database of the device again. The operation starts a configuration synchronization and can take up to a minute; in a cluster setup, since each device compiles its own database, it runs on both devices at once. While a synchronization is in progress, the button is disabled. It has no counterpart in WEB-CLI.

How Does It Work?

Change	Compilation
A state, score or scope change (Edit Rule Changes, Change State, Restore to Default)	None; the new values are applied with the configuration synchronization
A new custom rule or a change in the pattern of a custom rule	Only the relevant rule set: the global custom rules or the rules specific to that vService
A change in the compiler or in the processor platform of the device with a software update	At the next compilation, the whole database is produced again automatically
Recompile	The whole database from scratch, device-wide on both screens

If an error occurs during compilation, the existing signature database is preserved and the protection continues with the rule set that was compiled successfully last; if a single rule cannot be compiled, only that rule is not applied and it appears in the list with the (Faulty) suffix (If my custom rule fails to compile, does the WAF keep protecting; how do I find out?).

How Is Recompile Run?

1

Adım 1 Open the library screen

Configuration Menu → WAF → Signature & Rule Library is opened (how to access); the button on the vService's OWASP Rules screen does the same job as well.

2

Adım 2 Start Recompile

Recompile (hammer icon) on the toolbar is clicked. While a synchronization is running, the button is disabled and its icon turns into the spinning synchronization symbol. The button is not in the right-click menu of the row or in the preview title; it is not bound to a single rule.

3

Adım 3 Confirm

In the confirmation window, on a single device All WAF rules will be rebuilt from scratch and a configuration sync will run. Depending on system load, this can take up to a minute. Continue? appears, and in a cluster setup a text that also states that it will run on both devices at once appears. When it is confirmed, the Recompilation started. You can follow the progress from the sync indicator. notification appears; the progress is followed from the synchronization indicator of the interface.

Verification

1Rule listTR7 side

After the synchronization finishes, the area above the Signature & Rule Library list and the Faulty option in the Filter → State group are examined.

ExpectedNo compilation warning band · no Faulty rule

Common Misconceptions

• "Recompile is needed after every change." Compilation is automatic; Recompile is for exceptional cases.
• "Recompile on the vService screen compiles only that vService." On both screens, the button produces the whole signature database of the device again.
• "Recompile fixes a pattern that cannot be compiled." The pattern of the custom rule that cannot be compiled is fixed or the rule is deleted; Recompile does not change the pattern.

How it is done in the documentation

• Signature & Rule Library · Recompiling of the Signature Database
• Signature & Rule Library · Recompile
• OWASP Rules · The Counterpart of the Operations on This Screen

Related questions

• If my custom rule fails to compile, does the WAF keep protecting; how do I find out?
• I see rule 369999 in Debug Mode Logs or SIEM records; what is it?
• In a cluster, which device do WAF logs come from; how do I distinguish the device in Event Logs?