Deploy different logging profiles based on the HTTP host-name or URI

Some clarification please, are you trying to log all iRule log entries to different remote logging servers based on some HTTP request info?

 

or

 

Are you trying to setup something so the F5 LTM logs any standard ltm logs entries to different remote logging servers?

 

The first is possible and not to hard the second is not (or at at least very difficult and complex).

 

Dear AMG,

 

My scenario is closer to the first option, i wan to create an IRule to log the events based on the matched hostname of the http request, is this feasible?

 

Regards, Muhannad

 

You have two key options with this, you can configure multiple High Speed Logging (HSL) publisher then select the preferred publisher based on some HTTP Request data.

To do this configure your HSL publishers then in an iRule use

HSL::open -publisher 

to select and open the publisher. Once done you can use the HSL handler with:

HSL::send  

Example:

when HTTP_REQUEST {
    if {[HTTP:host] equals "www.test1.com "} {
        set hsl [HSL::open -publisher /Common/test1HSL]
    } else {
        set hsl [HSL::open -publisher /Common/defaultHSL]
    }
    
    HSL::send $hsl "<190> [IP::client_addr]:[TCP::client_port]->[IP::local_addr]:[TCP::local_port]; [HTTP::host][HTTP::uri]"
}

iRule High Speed Logging wiki

Second option if you are not using or do not want to use HSL you can log directly within an iRule to a server or IP (which could be a VS to load balance logging) using the standard log option:

when HTTP_REQUEST {
    if {[HTTP:host] equals "www.test1.com "} {
        set logServer "192.168.0.1"
    } else {
        set logServer "192.168.0.99"
    }
    
    log $logServer local0.info "<190> [IP::client_addr]:[TCP::client_port]->[IP::local_addr]:[TCP::local_port]; [HTTP::host][HTTP::uri]"
}

iRule log wiki

Hope this helps 🙂