<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:wfw="http://wellformedweb.org/CommentAPI/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
	xmlns:slash="http://purl.org/rss/1.0/modules/slash/"
	>

<channel>
	<title>The F5 Guy &#187; ASM Processes</title>
	<atom:link href="http://www.TheF5Guy.com/blog/index.php/tag/asm-processes/feed/" rel="self" type="application/rss+xml" />
	<link>http://www.TheF5Guy.com/blog</link>
	<description>F5 BIG-IP, SharePoint and Other Technologies...</description>
	<lastBuildDate>Tue, 07 Feb 2012 15:11:56 +0000</lastBuildDate>
	<language>en</language>
	<sy:updatePeriod>hourly</sy:updatePeriod>
	<sy:updateFrequency>1</sy:updateFrequency>
	<generator>http://wordpress.org/?v=3.1</generator>
		<item>
		<title>BIG-IP ASM 4100 Processes</title>
		<link>http://www.TheF5Guy.com/blog/2009/05/big-ip-asm-4100-processes/</link>
		<comments>http://www.TheF5Guy.com/blog/2009/05/big-ip-asm-4100-processes/#comments</comments>
		<pubDate>Thu, 14 May 2009 00:05:13 +0000</pubDate>
		<dc:creator>admin</dc:creator>
				<category><![CDATA[BIG-IP]]></category>
		<category><![CDATA[ASM]]></category>
		<category><![CDATA[ASM 4100]]></category>
		<category><![CDATA[ASM Processes]]></category>

		<guid isPermaLink="false">http://www.Thef5Guy.com/?p=255</guid>
		<description><![CDATA[A few weeks ago while deep diving into the BIG-IP ASM 4100 and what it can do, I began looking around for some documentation on the processes associated with the ASM module.  In particular I wanted to find out what those processes were and exactly what each of them did.  I thought it would make [...]]]></description>
			<content:encoded><![CDATA[<p>A few weeks ago while deep diving into the BIG-IP ASM 4100 and what it can do, I began looking around for some documentation on the processes associated with the ASM module.  In particular I wanted to find out what those processes were and exactly what each of them did.  I thought it would make a decent reference article for folks just getting involved with the ASM.</p>
<p>After looking around on the F5 website and through a few reams of paper searching for that information, I discovered that it didn&#8217;t exist in the public domain.  Therefore I opened up a ticket with the kind folks over at F5 regarding the matter.  Below is the end result of their hard work:<span id="more-255"></span></p>
<p><strong>bd </strong> &#8211; This process implements the ASM policy on the HTTP traffic it receives.<br />
<strong>If not running:</strong> No Traffic Passes<br />
<strong>Logs To: </strong> /ts/log/bd.log<br />
<strong><br />
bd_agent</strong> &#8211; Delivers policy configuration to the bd process and forwards bd events to the rest of the system.<br />
<strong>If not running:</strong> No enforcer configuration updates, no statistics (not including request log)<br />
<strong>Logs to:</strong> /var/log/asm, /ts/log/bd_agent.log</p>
<p><strong>dcc</strong> &#8211; The DCC process forwards policy updates to the bd via the bd_agent, handles bd events received from the bd_agent, and manages communications with the rest of the system.<br />
<strong>If not running:</strong> No enforcer configuration updates, no statistics (not including forensics)<br />
<strong>Logs to:</strong> /var/log/asm, /ts/log/dcc.log</p>
<p><strong>verify_dcc</strong> &#8211; A form of &quot;watchdog&quot; process that monitors the dcc process, and reports any failures to the recovery_mngr.pl, which handles restarting the dcc.<br />
<strong>If not running: </strong> No monitoring of dcc availability<br />
<strong>Logs to:</strong> /ts/log/verify_dcc.log, /var/log/asm</p>
<p><strong>mysqld</strong> &#8211; The mysql database process holding the policy as well as logs and policy builder data.<br />
<strong>If not running:</strong> Configuration will not load, no logging, no traffic passes.<br />
<strong>Logs to:</strong> /var/lib/mysqld.err</p>
<p><strong>verify_mysql</strong> &#8211; A form of &quot;watchdog&quot; process that monitors the mysqld server, restarts if it needed, and reports any failures to the recovery_mngr.pl process, which restarts the dcc processes, since they must reconnect to the DB after any failure.<br />
<strong>If not running: </strong> No monitoring of mysql availability<br />
<strong>Logs to:</strong> /var/log/verify_mysql.log, /var/log/asm</p>
<p><strong>clean_db</strong> &#8211; Monitors ASM DB tables, and prevents them from exceeding pre-defined limits on table size.<br />
<strong>If not running:</strong> No deletion of old database records, may fill the disk.<br />
<strong>Logs to:</strong> /ts/log/clean_db.log, /var/log/asm</p>
<p><strong>log_manager</strong> &#8211; In charge of ASM-specific log file tasks such as rotating and archiving the logs.<br />
<strong>If not running:</strong> ASM debug logs (non syslog) will not get rotated to tar archives.<br />
<strong>Logs to:</strong> /var/log/asm, /ts/log/log_manager.log</p>
<p><strong>recovery_manager </strong> &#8211; The process is in charge of starting the ASM daemons in their proper order, restarting daemons when watchdogs report failures.<br />
<strong>If not running:</strong> ASM will not recover from any failure.<br />
<strong>Logs to:</strong> /var/log/asm, /ts/log/recovery_mngr.log</p>
<p><strong>crawler_manager</strong> &#8211; Handles starting and stopping the policy builder via the GUI.<br />
<strong>If not running:</strong> No control of PB actions.<br />
<strong>Logs to:</strong> /ts/log/crawler_manager.log, /var/log/asm</p>
<p><strong>learning_manager</strong> &#8211; Populates the learning tables that are used in the processing building policies.<br />
<strong>If not running:</strong> No learning suggestions.<br />
<strong>Logs to:</strong> /ts/log/learning_manager.log, /var/log/asm</p>
<p><strong>attack_manager</strong> &#8211; Populates the &quot;Attacks Reports&quot;, based on security events.<br />
<strong>If not running:</strong> No statistics of attacks.<br />
<strong>Logs to:</strong> /ts/log/attack_manager.log, /var/log/asm</p>
<p><strong>nwd_core, nwd_ts, and nwd_dms</strong> &#8211; Multiple instances of &quot;watchdog&quot; processes that monitor ASM daemons, and attempt to restart them if they fail.  Reports failures to restart daemons to the recovery_mngr.pl process.  Covered in https://support.f5.com/kb/en-us/solutions/public/6000/500/sol6590.html<br />
<strong>If not running:</strong> ASM daemons won&#8217;t get brought up on failure.<br />
<strong>Logs to:</strong> /ts/log/nwd.log, /var/log/asm</p>
]]></content:encoded>
			<wfw:commentRss>http://www.TheF5Guy.com/blog/2009/05/big-ip-asm-4100-processes/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
	</channel>
</rss>

