Home Page

The WAF Status section is displayed on the UI home page if at least one Virtual Service has WAF enabled. The values shown here are as follows:

  • The total number of requests handled by the WAF shows all requests, whether they were blocked or not. Two requests are recorded for each connection – one incoming and one outgoing request.

  • The total number of events handled by the WAF, therefore requests that were blocked.

  • The number of events that have happened in the current hour since xx.00.00.

  • The number of events that have happened since 00.00 am local time.

  • The number of times the event counter has gone over the configured warning threshold today. For example, if the threshold is set to 10 and there have been 20 events, this counter will be set to 2. The warning threshold is set on a per-Virtual Service basis by filling out the Hourly Alert Notification Threshold field in the WAF section in the Virtual Service modify screen.

Statistics Page

To get to the WAF statistics page in the LoadMaster UI, go to Statistics > Real Time Statistics > WAF > Global. These statistics refresh every 5 to 6 seconds. The following items are displayed on this screen:

Count: The left-most column displays the total number of WAF-enabled Virtual Services.

Name: The name of the WAF-enabled Virtual Service.

Virtual IP Address: The IP address and port of the Virtual Service.

Protocol: The protocol of the Virtual Service (tcp or udp).

Status: Displays the status of the Virtual Service. For information on each of the possible statuses, refer to the Web User Interface (WUI) Configuration Guide.

Total Requests: The total number of requests handled by the WAF. This shows all requests, whether they were blocked or not. Two requests are recorded for each connection – one incoming and one outgoing request.

Total Events: The total number of events handled by the WAF (requests that were blocked).

Events this hour: The number of events that have happened in the current hour since xx.00.00.

Events Today: The number of events that have happened since 00.00 am local time.

Events over Limit Today: The number of times the event counter has gone over the configured warning threshold today. For example, if the threshold is set to 10 and there have been 20 events, this counter will be set to 2. The warning threshold is set on a per-Virtual Service basis by filling out the Hourly Alert Notification Threshold field in the WAF section in the Virtual Service modify screen.

Countries: Click Countries in the top right of the page to display the screen that contains a list of the top 10 blocked countries.

These WAF statistics can also be seen in the Virtual Service statistics screen (go to Statistics > Real Time Statistics > Virtual Services and then click the Virtual IP Address link).