Atomicorp

the logs that appear in the console

i.e:

--2fda2e0f-A--
[11/Nov/2019:15:11:04 +0000] Xcl6COp4VYLCwBb@9J7cDwAAABE 18.194.95.82 20132 10.25.0.10 443
--2fda2e0f-B--
POST /fakeurl.htm HTTP/1.1
Host: **********************
Accept-Charset: iso-8859-1,utf-8;q=0.9,*;q=0.1
Accept-Language: en
Connection: Close
Content-Length: 25
User-Agent: NetSupport Manager/1.0
Pragma: no-cache
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, image/png, */*

and so on.

i guess these are logged to the db? but are they also logged to file, if so where can i find them in the system?

WAF events are logged concurrently to the event data repository with one per event and are stored by default in this location on the system:

/var/asl/data/audit/apache