Bug ID 681178: No way to determine AFM functional area mapping to log signature IDs for logs

Last Modified: Jan 29, 2019

Bug Tracker

Affected Product:  See more info
BIG-IP AFM(all modules)

Known Affected Versions:
11.6.0, 11.6.0 HF1, 11.6.0 HF2, 11.6.0 HF3, 11.6.0 HF4, 11.6.0 HF5, 11.6.0 HF6, 11.6.0 HF7, 11.6.0 HF8, 11.6.1, 11.6.1 HF1, 11.6.1 HF2, 11.6.2, 11.6.2 HF1, 11.6.3, 11.6.3.1, 11.6.3.2, 11.6.3.3, 11.6.3.4, 12.0.0, 12.0.0 HF1, 12.0.0 HF2, 12.0.0 HF3, 12.0.0 HF4, 12.1.0, 12.1.0 HF1, 12.1.0 HF2, 12.1.1, 12.1.1 HF1, 12.1.1 HF2, 12.1.2, 12.1.2 HF1, 12.1.2 HF2, 12.1.3, 12.1.3.1, 12.1.3.2, 12.1.3.3, 12.1.3.4, 12.1.3.5, 12.1.3.6, 12.1.3.7, 12.1.4, 13.0.0, 13.0.0 HF1, 13.0.0 HF2, 13.0.0 HF3, 13.0.1, 13.1.0, 13.1.0.1, 13.1.0.2, 13.1.0.3, 13.1.0.4, 13.1.0.5, 13.1.0.6, 13.1.0.7, 13.1.0.8, 13.1.1, 13.1.1.1, 13.1.1.2, 13.1.1.3, 13.1.1.4

Fixed In:
14.0.0

Opened: Aug 31, 2017
Severity: 3-Major

Symptoms

There is no way to determine which log IDs are associated with which functional area in AFM.

Impact

Cannot determine the mapping between functional area and log IDs.

Conditions

-- AFM configured. -- Logs are generated.

Workaround

None.

Fix Information

The following list defines which log IDs are associated with which functional area in AFM: -- NETWORK_ACL = 23003137; -- DOS_NETWORK = 23003138; -- PROTOCOL_DNS = 23003139; -- DOS_APPLICATION = 23003140; -- DOS_PROTOCOL_DNS = 23003141; -- IP_INTELLIGENCE = 23003142; -- IPS_LOG = 27590657; -- //23003143 is not being used -- TRAFFIC_FLOW_STATS = 23003155; -- TRAFFIC_SYNCOOKIE_STATS = 23003156; -- THROTTLED_MESSAGES = 23003154; -- PROTOCOL_SIP = 23003144; -- DOS_PROTOCOL_SIP = 23003145; -- PROTOCOL_HTTP = 23003146; -- PEM_LOG = 24182785; -- CONFIG_CHANGE_LOG= 23003158; -- PORT_MISUSE_LOG = 23003157; -- RTBH_LOG = 23003163; -- SHUN_LOG = 23003159; -- NAT_LOG = 23003161; -- NAT_ERR_LOG = 23003162; -- NAT_PB_LOG = 23003168; -- DOS_THRESHOLD = 23003160; -- DYNAMIC_SIGNATURES = 23003173; -- BOTDEFENSE_REQUESTS = 23003147; -- SCRUBBER_LOG = 23003172; -- CLASSIFICATION_LOG = 27656193; -- PROTOCOL_SSH_AUTH = 23003164; -- PROTOCOL_SSH_ACTION = 23003165; -- PROTOCOL_SSH_TRAFFIC = 23003167; -- PROTOCOL_SSH_EVENTS = 23003166;

Behavior Change