Forum Discussion

Rwitzel_80238's avatar
Rwitzel_80238
Icon for Nimbostratus rankNimbostratus
May 08, 2013

ASM response logging rate limit

I created a ASM policy recently, and it works as expected with 1 exception. In the logging on many of the requests when you click on HTTP Response you see a message that states "Response rate limit was reached", or "Content type is not supported for response logging". I can't seem to find any information anywhere about these messages. Has anyone here seen either of these messages in ASM? Any tips would be appreciated.

 

 

My system is a BIG-IP 3900 running version 11.2.1 (Build 1148.0)

 

 

Thanks

 

app sec
BIG-IP Access Policy Manager (APM)
security
  • Torti's avatar
    Torti
    Icon for Altostratus rankAltostratus
    May 13, 2013
    Hi,

     

     

    I did see the the same messages in my log in the past, too. Im not 100% sure, but...

     

    "Response rate limit was reached" means, there is to much traffic for response logging. So there are to many responses for logging.

     

    So, you could deactivate response logging in all other policies.

     

    You could try the high speed logging profile on ltm side. In 11.3, they changed logging. There it is assigned with the virtaul server and not with the policy.

     

     

    The second should be the same like "Response was not logged because the system does not support response logging of this content type".

     

    This message is called for non html files, like js or css. The response have to contain a header like "Content-Type: text/html;charset=UTF-8".

     

    But I dont know, which other file types are supported.

     

     

    regards
  • Torti's avatar
    Torti
    Icon for Altostratus rankAltostratus
    May 14, 2013
    supported content types in 11.3:

     

    "text/..."

     

    • "application/x-shockwave-flash"

     

    • "application/sgml"

     

    • "application/x-javascript"

     

    • "application/xml"

     

    • "application/x-asp"

     

    • "application/x-aspx"

     

    • "application/xhtml+xml"

     

    • "application/soap+xml"

     

    • "application/json"
  • Torti's avatar
    Torti
    Icon for Altostratus rankAltostratus
    May 14, 2013
    supported content types in 11.3:

     

    • "text/..."

     

    • "application/x-shockwave-flash"

     

    • "application/sgml"

     

    • "application/x-javascript"

     

    • "application/xml"

     

    • "application/x-asp"

     

    • "application/x-aspx"

     

    • "application/xhtml+xml"

     

    • "application/soap+xml"

     

    • "application/json"
  • Torti's avatar
    Torti
    Icon for Altostratus rankAltostratus
    May 14, 2013

    supported content types in 11.2:

     

    • "text/..."

     

    • "application/x-shockwave-flash"

     

    • "application/sgml"

     

    • "application/x-javascript"

     

    • "application/xml"

     

    • "application/x-asp"

     

    • "application/x-aspx"

     

    • "application/xhtml+xml"

     

    • "application/soap+xml"

     

    • "application/json"

     

  • Mr__Katic_15215's avatar
    Mr__Katic_15215
    Icon for Altocumulus rankAltocumulus
    Dec 16, 2015

    Response rate logging is limited on 10 responses per second, including first 10KB per response. This is by design, logging daemon is competing for system resources just like any other. If you want to change it select Guarantee Logging in Logging profile and select same for Response Logging. Before that make sure your system is not near some bottlenecks. Other way is to change limitation from system variables but that should be done as last options, preferable in consultation with F5 TS. If you don't need response logging at all turn it off...

     

    Regarding second message (content type) i believe Torti gave fine answer.