Log types
F5 WAF for NGINX generates three types of logs:
- Security logs, which record HTTP requests and how F5 WAF processes them, including violations and detected signatures.
- Operation logs, covering F5 WAF events such as startup, shutdown and reconfiguration.
- Debug logs, recording technical messages at different levels of severity used to debug and resolve incidents and error behaviors.
F5 WAF for NGINX can also be configured to add additional data to the NGINX access logs.
F5 WAF for NGINX and NGINX itself do not have logs for auditing system user interactions.
These events should be examined in the orchestration system controlling NGINX (such as NGINX Ingress Controller), or by tracking configuration files and their systemd invocations.
F5 WAF for NGINX uses a separate logging mechanism to NGINX’s default one, which is responsible for access logs.
| Type | Log configuration | Configuration contexts | File destination | Syslog destination |
|---|---|---|---|---|
| Security | app_protect_security_log directive referencing security_log.json file |
nginx.conf: http, server, location |
Yes, either stderr, or an absolute path to a local file are supported |
Yes |
| Operation | error_log directive, part of core NGINX |
nginx.conf - global |
Yes, NGINX error log | Yes, NGINX error log |
| Debug | /etc/app_protect/bd/logger.cfg. Log file name is the redirection in the invocation of the bd command line in the start script |
Global (not part of nginx.conf) | Yes. Log file is in /var/log/app_protect default debug directory. No file rotation currently |
No |