TransactionID in Application Gateway v1 versus v2

Question

In AppGWv2 the TransactionID in the Firewall Log is a GUID (transactionId_g) and unique to each transaction. It can be used to correlate multiple OWASP rules that were triggered in the same transaction. For example where an OWASP rule has blocked traffic via anomaly scoring there is always exactly one ruleId_s=949110 in the log, and then one or more other rules that contributed to the anomaly score. And the TimeGenerated is always the same value for all logs with the same transactionId_g. This make analysis easy.

However in AppGWv1 the Transaction ID is a string (transactionId_s) and is not unique for a single transaction. The anomaly score shows ruleID_s=0 (compared to 949110 for AppGWv2). And I have many examples where there are multiple occurrences of ruleID_s=0 for the same transactionId_s. And the same transactionId_s can be seen across a time range, in some cases spanning multiple hours. So it seems transactionId_s is either not accurate or is being reused, which makes it very difficult to correlate events and analysis.

Is there any better way than transactionId_s to correlate the various log entries for AppGWv1?

Answer 1

@Anonymous

Welcome to the Microsoft Q&A Platform. Thank you for reaching out & I hope you are doing well.

Your observation is correct.

• The reuse of transaction IDs is a normal behavior in Application Gateway v1 and does not necessarily indicate an issue or problem.
• It is important to note that the transaction ID is only intended to be used for troubleshooting and logging purposes and should not be relied upon for tracking or identifying individual requests.

Kindly let us know if this helps or you need further assistance on this issue.

Thanks,

Kapil

---

Please don’t forget to close the thread by clicking "Accept the answer" wherever the information provided helps you, as this can be beneficial to other community members.