For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Teerarat's avatar
Teerarat
Icon for Cirrostratus rankCirrostratus
Aug 29, 2018

Count data that match with event

Hi can i cound data that match with event, Example i would like to count how many client that match with network address.

 

2 Replies

  • One super easy way to do this is with a stats profile.

    1. Create a stats profile -> Local Traffic -> Profiles -> Other -> Statistics. Give it a name and define at least one field. (ex. "stats-test", field 1 = "triggered")

    2. Assign the stats profile to the VIP.

    3. In an iRule, in the event you want to capture, increment the stats profile field(s).

      STATS::incr stats-test triggered
      

    After some time, look at the accumulated value in TMSH:

    tmsh show ltm profile statistics test-stats
    

    Example output:

    -----------------------------------
    Ltm::Profile Statistics: test-stats
    -----------------------------------
    triggered  14
    

    .

    You could also do this with iStats, a later and more powerful version of the above: https://devcentral.f5.com/wiki/iRules.ISTATS.ashx .

    Or you could increment a table value, which you'd then be able to read from an iRule.

  • Hi,

    You can also do it with table session:

    when HTTP_REQUEST { 
    
    set tablesvalues [table lookup count]
    
    if {$tablesvalues == ""} {
        table set count 1
    } else {
        set new_count_value [expr {$tablesvalues + 1}]
        table set count $new_count_value
    }
    
    log local0. "[table lookup count]"
    
    
    if { ( [HTTP::uri] equals "/countpage" ) } {
        HTTP::respond 200 content "[table lookup count]"
    }
    
    }
    

    the advantage with this irule is that you can add conditions (by IP, by URI, ...).

    I let you a log in irule you can remove it an check count directly using your browser:

    Hope it help you. let me know if you need more details...

    regards

    You can also remove