Forum Discussion

Fozail_183609's avatar
Fozail_183609
Icon for Nimbostratus rankNimbostratus
Jan 14, 2019

This request is not shown in the list because it was marked for delete

Dear Expert,

 

I can see very often request logs are being marked as "This request is not shown in the list because it was marked for delete" @ Security ›› Event Logs : Application : Requests

 

Logs are very latest one, even just one hour or half an hour old logs but still being marked as "This request is not shown in the list because it was marked for delete"

 

Is there any specific reason for this.

 

F5 is running 13.1.1.3

 

1 Reply

  • Do you have 'Log All Requests' logging policy for ASM events or 'Log Illegal Requests Only'?

     

    If you have 'Log All Requests' remember that ASM only keeps the last 100,000 requests in the internal event logs, so by the time you click on a request to investigated it may gave been already deleted as you probably already had 100,000 more requests logged in that time period (you mention one hour) .

     

    Remember that ASM's primary function is a security device and not a logging device. In production environments it is not recommended to use 'Log All Requests' policy with local storage - instead you should ship the ASM logs to an external SIEM/logging system such as Splunk.

     

    If you have 'Log Illegal Requests' only Logging policy and you are still frequently getting the 'deleted' error - raise a Support Case with the F5 Support team.