ASM send mail alert when request violation with iRule
Hi all
I have F5-ASM (11.3.0), when ASM have violation or blocking request, I want F5 notice me via email.
I have configed F5-ASM send email when have request blocking. But I want in body of email show more information detail about this request is blocked or violation like this: violation_type; status request; ip client source... all in one email
Currently when I recieved email i just know only one information is Support_id of violation. I using iRule to capture Support_id from ASM log, here is iRule i found on Devcentral:
when ASM_REQUEST_VIOLATION {
log local3. "Support_id: [lindex [ASM::violation_data] 1]"
}
and modify in /config/user_alert.conf to send email:
alert ASM_MAIL "Support_id" {
email toaddress="abc@company.com"
fromaddress="monitor"
body="The ASM Blocking"
}
==> this way work fine but with one information is "Support_id"
=======================
I have tried to insert other information in iRule :
when ASM_REQUEST_VIOLATION {
log local3. "Support_id: [lindex [ASM::violation_data] 0]"
log local3. "Support_id: [lindex [ASM::violation_data] 1]"
log local3. "Support_id: [lindex [ASM::violation_data] 2]"
.......
}
This way i can recieved 2 or 3 email every have request blocked or violation but these informations not stay same one email ??
So hope everyone help this issue ?
Thanks