analytics dos-vis-common report
analytics dos-vis-common reporBIG-IP TMSH Maanalytics dos-vis-common report(1)
NAME
report - Displays a DoS Common analytics report.
MODULE
analytics dos-vis-common
SYNTAX
Show, save or send a analytics dos-vis-common report using the syntax
shown in the following sections.
DISPLAY
show report view-by [ activity-type | application | attack-id | client-ip | country | country-code | dos-profile | mitigation |
protocol | suspected-ip | trigger | vector | virtual ]
options:
drilldown {
{
entity [ activity-type | application | attack-id | client-ip | country | country-code | dos-profile | mitigation |
protocol | suspected-ip | trigger | vector | virtual ]
values
{
[value ...]
}
} ...
}
field-fmt
include-total
include-others
limit [number of rows]
measures {
[measure name ...]
}
order-by {
{
measure [ measure name ]
sort-type [ asc / desc ]
} ...
}
range [date range]
SAVE
save report view-by [ activity-type | application | attack-id | client-ip | country | country-code | dos-profile | mitigation |
protocol | suspected-ip | trigger | vector | virtual ]
options:
drilldown {
{
entity [ activity-type | application | attack-id | client-ip | country | country-code | dos-profile | mitigation |
protocol | suspected-ip | trigger | vector | virtual ]
values
{
[value ...]
}
} ...
}
file [ file name ]
format [ csv-aggregated | csv-time-series | pdf ]
include-total
include-others
limit [number of rows]
measures {
[measure name ...]
}
order-by {
{
measure [ measure name ]
sort-type [ asc / desc ]
} ...
}
range [date range]
SEND
send-mail report view-by [ activity-type | application | attack-id | client-ip | country | country-code | dos-profile | mitigation |
protocol | suspected-ip | trigger | vector | virtual ]
options:
drilldown {
{
entity [ activity-type | application | attack-id | client-ip | country | country-code | dos-profile | mitigation |
protocol | suspected-ip | trigger | vector | virtual ]
values
{
[value ...]
}
} ...
}
email-addresses {
[email address ...]
}
format [ csv-aggregated | csv-time-series | pdf ]
include-total
include-others
limit [number of rows]
measures {
[measure name ...]
}
order-by {
{
measure [ measure name ]
sort-type [ asc / desc ]
} ...
}
range [date range]
smtp-config-override [ smtp configuration object name ]
DESCRIPTION
Use this command to generate DoS Common analytics reports. You can
generate a DoS Common analytics report for the following entities:
o activity-type - Tells whether a transaction was created by client
regular activity or due to BIG-IP internal activity/injected
JavaScripts.
o application - Application services.
o attack-id - Attack's unique ID.
o client-ip - A single client identified by an IP address.
o country - The name of the country from which the traffic arrived.
o country-code - An ISO 3166-1 Alpha-2 country code from which the
traffic arrived.
o dos-profile - Name of the DoS Profile involved in classifying
relevant traffic as attack.
o mitigation - The mitigation of the attack.
o protocol - The protocol that was attacked (HTTP/SIP/DNS/L3).
o suspected-ip - Is this IP suspected by dos module as "attacking".
o trigger - The trigger of the attack.
o vector - The vector of the attack.
o virtual - Name of the virtual server.
Different measures are collected for each of these entities and can be
a part of the report request.
EXAMPLES
show analytics dos-vis-common report view-by activity-type
show analytics dos-vis-common report view-by activity-type drilldown {
{ entity virtual values { virtual_1 virtual_2 } } }
send-mail analytics dos-vis-common report view-by activity-type
measures { network-dropped-requests-per-second } limit 20 order-by { {
measure network-dropped-requests-per-second sort-type desc } } format
pdf email-addresses { some.one@someaddress.com }
For more syntactical examples, see the tmsh help manual for analytics
report.
OPTIONS
device
Specifies a BIG-IP device on which to generate a report.
(Enterprise Manager only)
device-list
Specifies a custom list of BIG-IP devices on which to generate a
report. (Enterprise Manager only)
drilldown
Specifies specific entities that are used as a filter.
email-addresses
Specifies the list of email addresses to which the report file is
sent when using the send-mail command.
file Specifies the exported file path to be saved when using the save
command. The file name should be simple (not a full path).
format
Specifies the exported file format to be saved or sent. This
option must be specified when using the save or send-mail
commands.
include-others
Specifies that the grand total for the measure is displayed for
all entities, except for those shown in the result. It can be used
along with include-total.
include-total
Specifies that a total summary row should be added to the
analytics report. For average measures, the total value is also an
average.
limit
Specifies the maximum number of rows/entities in the output result
set/file. The default value is 10, not including the total
row/entity. The maximum value is 1000.
measures
Specifies a list of measures that can be used with the chosen
entity type. The options are:
attacks-count
Number of distinct attacks.
average-tps
Average number of transactions per second (tps).
dns-hits-count
The total number of DNS packets.
http-transactions
The absolute number of transactions for each entity.
network-allowed-requests
Total number of attacking network requests that were allowed
by AFM.
network-allowed-requests-per-second
Average number of network-attacking requests allowed per
second.
network-dropped-requests
Total number of dropped network requests.
network-dropped-requests-per-second
Average number of network-attacking requests dropped per
second.
network-total-requests
Total number of attacking requests.
network-total-requests-per-second
Average number of attacking requests per second (allowed and
dropped).
packets-per-second
Average DNS packets per second.
sip-hits-count
The total number of SIP requests.
sip-requests-per-sec
Average number of SIP requests per second.
order-by
Specifies the measures and sort type (ascending or descending)
that will be used to sort the final report. The value for each
measure is a previously chosen measure. The default value for sort
type is desc (descending).
range
Specifies the time/date range of the analytics information that
you want to display. The given results will reflect the time range
chosen here. The default value is the last hour (now--now-1h).
smtp-config-override
Specifies the SMTP configuration to use when sending reports by
email. This overrides the default SMTP settings.
SEE ALSO
show, save, send-mail, tmsh, ltm profile analytics, analytics,
analytics report
COPYRIGHT
No part of this program may be reproduced or transmitted in any form or
by any means, electronic or mechanical, including photocopying,
recording, or information storage and retrieval systems, for any
purpose other than the purchaser's personal use, without the express
written permission of F5 Networks, Inc.
F5 Networks and BIG-IP (c) Copyright 2008-2018. All rights reserved.
BIG-IP 2018-07-05analytics dos-vis-common report(1)