Events after HTTP_REQUEST

For a single connection here's the order of the HTTP events fired

Request:

CLIENT_ACCEPTED

HTTP_REQUEST

HTTP_REQUEST_DATA (** if HTTP::collect called in HTTP_REQUEST)

LB_SELECTED

SERVER_CONNECTED

Response:

HTTP_REQUEST_SEND

HTTP_RESPONSE

HTTP_RESPONSE_DATA (** if HTTP::collect called in HTTP_RESPONSE)

SERVER_CLOSED

CLIENT_CLOSED

You can test this out with the following rule (look in /var/log/ltm for the output):

when RULE_INIT {  
    log local0. "in RULE_INIT"  
  }  
  when HTTP_CLASS_SELECTED {  
    log local0. "in HTTP_CLASS_SELECTED"  
  }  
  when HTTP_REQUEST {  
    log local0. "in HTTP_REQUEST"  
  }  
  when HTTP_REQUEST_DATA {  
    log local0. "in HTTP_REQUEST_DATA"  
  }  
  when HTTP_REQUEST_SEND {  
    log local0. "in HTTP_REQUEST_SEND"  
  }  
  when HTTP_RESPONSE {  
    log local0. "in HTTP_RESPONSE"  
  }  
  when HTTP_RESPONSE_DATA {  
    log local0. "in HTTP_RESPONSE_DATA"  
  }  
  when HTTP_RESPONSE_CONTINUE {  
    log local0. "in HTTP_RESPONSE_CONTINUE"  
  }  
  when CLIENT_ACCEPTED {  
    log local0. "in CLIENT_ACCEPTED"  
  }  
  when CLIENT_CLOSED {  
    log local0. "in CLIENT_CLOSED"  
  }  
  when CLIENT_DATA {  
    log local0. "in CLIENT_DATA"  
  }  
  when SERVER_CLOSED {  
    log local0. "in SERVER_CLOSED"  
  }  
  when SERVER_DATA {  
    log local0. "in SERVER_DATA"  
  }  
  when LB_SELECTED {  
    log local0. "in LB_SELECTED"  
  }  
  when LB_FAILED {  
    log local0. "in LB_FAILED"  
  }  
  when NAME_RESOLVED {  
    log local0. "in NAME_RESOLVED"  
  }  
  when USER_REQUEST {  
    log local0. "in USER_REQUEST"  
  }  
  when USER_RESPONSE {  
    log local0. "in USER_RESPONSE"  
  }  
  when SERVER_CONNECTED {  
    log local0. "in SERVER_CONNECTED"  
  }  
  when SERVER_LINE {  
    log local0. "in SERVER_LINE"  
  }

This isn't an exhaustive list of events, but the ones related to HTTP connections without ssl, auth, etc profiles associated with them.

One thing to note is that the LB_SELECTED event will only be fired when a new load balancing decision has been made. Keep-alive connections will receive the other events, but only the LB_SELECTED event when it's at the start of a new session. If you want the last event before the data is sent, I'd use the HTTP_REQUEST_SEND event.

-Joe