Forum Discussion
Eric_Weiss_2486
Nimbostratus
NimbostratusExtra pair/s of eyes need to verify HTTP::cookie logic
Can anyone see glaring logic issues with the following?
when HTTP_REQUEST {
set LogString "Client [IP::client_addr]:[TCP::client_port] -> [HTTP::host][HTTP::uri]"
log local0. "=================...
Eric_Weiss_2486Nimbostratus
NimbostratusI figured it out and was able to come up with something a little more elegant. Also, added logging for cookie and user-agent. The rule broke when adding all of the || and && conditions, like above. Changed logic for HTTP::cookie so that it isn't using 'not' (since that expects a numeric value instead of alpha), and changed the HTTP::uri regex that wasn't working, to HTTP::host.
