Forum Discussion
AltostratusAAM and HSL to splunk
We are in the process of adding AAM to our corporate webserver. Currently we log centrally log our webservers for analytics. When we introduce AAM these logs will not necessarily be a true representation of all the traffic.
So now I am looking at using the Splunk for F5 app, with HSL to log centrally. I have two questions regarding this new configuration: 1) Will the traffic served from the AAM cache hit HTTP_RESPONSE event, so that it will be HSL to splunk. 2) Can I modify the irule slightly to include information regarding the cache, similar to the X-WA-Header does?
Terry
3 Replies
TerrenceNimbostratus
So I thought that I could use a Request logging profile, however all the variables created by the irule are not available in the logging profile. Specifically HTTP_HOST, which I thought was quite odd.
From what I can tell there is no way to log requests that are served from the AAM cache, nor information regarding the X-WA-Info
- Terrence
So I managed to figure this out using a vip-to-vip configuration, with the splunk-f5 irule on the outside vip and wam configured on the inside vip. A couple of additional things
The inside vip sets some HTTP headers when HTTP_RESPONSE which passes pool,node, and vip information to the outside vip.
The outside vip does the splunk hsl logging in HTTP_RESPONSE. I also added x_wa_info to the logs
The inside vip logs lb_fails.
This is the only way I managed to get consistent logging with wam.
Philip_Lim_1751These seems to be the case. There are other similar older questions that were not answered. So I assume as Terry mentions that logging requests served from the AAM cache is not possible.
