For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

RiverFish's avatar
RiverFish
Icon for Altostratus rankAltostratus
Jun 06, 2017

Can't disable debug logging.

I have a couple of VIPs using an iRule for persistence. If I set debug to "0" (disabled) it just keeps on logging, even if I comment out the log lines. It just doesn't want to obey, what gives? Anyone ever seen this? It's flooding my logs.

(/S2-green-P:Active)(/Common)(tmos) list ltm virtual *RAD* profiles persist 
ltm virtual VIP-SGPNH-NACVIP001.AP.XOM.COM-RADIUS-ACCOUNTING {
    persist {
        radius-mac-sticky {
            default yes
        }
    }
    profiles {
        radiusLB {
            context all
        }
        udp {
            context all
        }
    }
}
ltm virtual VIP-SGPNH-NACVIP001.AP.XOM.COM-RADIUS-AUTH {
    persist {
        radius-mac-sticky {
            default yes
        }
    }
    profiles {
        radiusLB {
            context all
        }
        udp {
            context all
        }
    }
}

    (cfg-sync In Sync)(/S2-green-P:Active)(/Common)(tmos) list ltm persistence universal radius-mac-sticky 
ltm persistence universal radius-mac-sticky {
    app-service none
    defaults-from universal
    match-across-services enabled
    rule radius-mac-sticky
}

    (cfg-sync In Sync)(/S2-green-P:Active)(/Common)(tmos) list ltm rule radius-mac-sticky 
ltm rule radius-mac-sticky {
     ISE persistence iRule based on Calling-Station-Id (MAC Address) with fallback to NASIP-Address as persistence identifier

when CLIENT_DATA {
      0: No Debug Logging 1: Debug Logging
     set debug 1

      Persist timeout (seconds)
     set nas_port_type [RADIUS::avp 61 "integer"]
     if {$nas_port_type equals "19"}{
     set persist_ttl 3600
     if {$debug} {set access_media "Wireless"}
     } else {
     set persist_ttl 28800
     if {$debug} {set access_media "Wired"}
     }

      If MAC address is present - use it as persistent identifier
      See Radius AV Pair documentation on https://devcentral.f5.com/wiki/irules.RADIUS__avp.ashx

     if {[RADIUS::avp 31] ne "" }{
     set mac [RADIUS::avp 31 "string"]

      Normalize MAC address to upper case

     set mac_up [string toupper $mac]
     persist uie $mac_up $persist_ttl
     if {$debug} {
               set target [persist lookup uie $mac_up]
               log local0.alert "Username=[RADIUS::avp 1] MAC=$mac Normal MAC=$mac_up MEDIA=$access_media TARGET=$target"
          }
     } else {
          set nas_ip [RADIUS::avp 4 ip4]
          persist uie $nas_ip $persist_ttl
          if {$debug} {
               set target [persist lookup uie $nas_ip]
               log local0.alert "No MAC Address found - Using NAS IP as persist id. Username=[RADIUS::avp 1] NAS IP=$nas_ip MEDIA=$access_media TARGET=$target"
             }
       }
}
}

1 Reply