Understanding OWASP WAF Logs

When reviewing the Kemp WAF logs there is no "action" indicated in the logs. Do the WAF logs show if there is an action to drop traffic or if the traffic successfully reaches the server?

Product: LoadMaster

Version: Any

Platform: Any

Application: HTTP(S) Based

How to understand which WAF logs depict that a connection has been blocked?

 There are three audit modes that determine what information is logged:
- No Audit: No data is logged.
- Audit Relevant: Logs data that is of a warning level and higher. This is the default option for this setting.
- Audit All: Logs all data through the Virtual Service.
 

If a connection does not reach the full Anomaly Scoring Threshold but triggers a rule, the connection will be logged at the "Warning" level.
The warning logs will look similar to the following:

Warning. Pattern match

 
If the connection reaches the anomaly threshold, the connection will be blocked. 
Within the log files, the connection is logged at the "Critical" level. The user will receive "Access Denied".
These logs will look similar to the following:

Access denied with code 403