Forum Discussion

John_Ogle_45372's avatar
John_Ogle_45372
Icon for Nimbostratus rankNimbostratus
Sep 05, 2013

Extensive logging - best option? normal syslog? HSL? other?

I am doing some extensive logging temporarily in my irule. It was suggested that I may want to look at using HSL. The last time I tried this, the formatting was terrible. Was is the best option for logging a lot of data? Pros/Cons? If HSL is the answer, what are my options or usual solutions for cleaning up the output? Thank you,

 

deployment

3 Replies

  • Kevin_Stewart's avatar
    Kevin_Stewart
    Icon for Employee rankEmployee
    Sep 05, 2013

    Curious, are you referring to request or remote logging? Using HSL in an iRule you can format the messages any way you like.

     

  • John_Ogle_45372's avatar
    John_Ogle_45372
    Icon for Nimbostratus rankNimbostratus
    Sep 05, 2013

    You posted in my other thread to be careful of high amount of logging off the box when using this rule. I dabbled with HSL when it first came out but the formatting was a challenge. Also, I believe the logging has been updated in 11.x so I was trying to determine the best option. I like normal syslog output I get from below but I lose ith HSL since it is raw if I remember correctly.

     

    when SERVER_CONNECTED { log local0. "client [IP::client_addr]:[TCP::client_port] snat [IP::local_addr]:[TCP::local_port] server [IP::server_addr]:[TCP::server_port]" }

     

  • Kevin_Stewart's avatar
    Kevin_Stewart
    Icon for Employee rankEmployee
    Sep 06, 2013

    HSL does tend to remove the event name and first word in the message (odd), but otherwise it looks exactly as it should.

    when SERVER_CONNECTED { 
    log local0. "client [IP::client_addr]:[TCP::client_port] snat [IP::local_addr]:[TCP::local_port] server [IP::server_addr]:[TCP::server_port]" 
    HSL::send $hsl "HSL client [IP::client_addr]:[TCP::client_port] snat [IP::local_addr]:[TCP::local_port] server [IP::server_addr]:[TCP::server_port]" 
}

    Local LTM log:

    : client 10.70.0.1:59441 snat 10.70.0.100:59441 server 10.70.0.1:80

    Remote syslog:

    client 10.70.0.1:59441 snat 10.70.0.100:59441 server 10.70.0.1:80