BIG IP ASM Reporting

By default, logs are stored locally. The Local Storage check box is selected and cannot be cleared unless you enable Remote Storage to store logs remotely. This prevents you from creating a logging profile that does not log any traffic.

To store logs locally only, leave the Local Storage check box selected.

To store logs remotely, select the Remote Storage check box.

To store logs both places, select both check boxes. Optional for local logging: To ensure that the system logs requests for the security policy, even when the logging utility is competing for system resources, select the Guarantee Local Logging check box. From the Response Logging list, select one of the following options.

By default, the system logs the first 10000 bytes of responses, up to 10 responses per second. You can change the limits by using the response logging system variables. By default, the system logs all requests. To limit the type of requests that the system or server logs, set up the Storage Filter.

If setting up local event logging only, click Finished. To set up remote logging, continue to set up remote logging.

When you store the logs locally, the logging utility may compete for system resources. Using the Guarantee Logging setting ensures that the system logs the requests in this situation but may result in a performance reduction in high-volume traffic applications.

Hence its always recommend to have remote logging, best practice say use ArcSight, Eventlog Analyzer (mostly freeware available e;g ManageEngine log Analyzer) or you can user checkpoint logger.

Cheers ... Jai

I Hope it helps!!