Forum Discussion

TFleming's avatar
TFleming
Icon for Nimbostratus rankNimbostratus
Apr 17, 2020

Find connection attempts via source IP

Hey guys, I'm fairly new to F5. We have one configured before I started working here. We have a windows terminal server virtual server in our F5 that load balances between 18 different back end termi...
application delivery
BIG-IP
devops
TMSH
  • Beaker's avatar
    Beaker
    Apr 20, 2020
    when CLIENT_ACCEPTED {
  set LogString "Client [IP::client_addr]"
  log local0. "==== $LogString (request) ====="
}
 
when SERVER_CONNECTED {
  log local0. "==== $LogString (server connected) - server: [LB::server addr]:[LB::server port] ===="
}

    I have tested that this works

Beaker's avatar
Beaker
Icon for Cirrus rankCirrus
Apr 17, 2020

You should be able to just remove the HTTP calls from the rule I posted above like so and it should work:

when CLIENT_CONNECTED {
  set LogString "Client [IP::client_addr]:[TCP::client_port]
  log local0. "==== $LogString (request) ====="
}
 
when SERVER_CONNECTED {
  log local0. "==== $LogString (server connected) - server: [LB::server addr]:[LB::server port] ===="
}
  • TFleming's avatar
    TFleming
    Icon for Nimbostratus rankNimbostratus
    Apr 17, 2020

    ​Sadly I still get an error "01071912:3: HTTP_REQUEST event in rule (/Common/LogLocalConnections) requires an associated HTTP or FASTHTTP profile on the virtual-server (/Common/RDS-2016-VIP)." with the above iRule.

    • Beaker's avatar
      Beaker
      Icon for Cirrus rankCirrus
      Apr 18, 2020

      Sorry forgot to change the irule event when I edited it before. I have updated the code above. This does not use http processing events rather just tcp events

    • TFleming's avatar
      TFleming
      Icon for Nimbostratus rankNimbostratus
      Apr 20, 2020

      ​Good morning Beaker. New error. "01070151:3: Rule [/Common/LogLocalConnections] error: /Common/LogLocalConnections:1: error: [unknown event (CLIENT_CONNECTED)][when CLIENT_CONNECTED {

      set LogString "Client [IP::client_addr]:[TCP::client_port]"

      log local0. "==== $LogString (request) ====="

      }]". The code I have is:

       

      when CLIENT_CONNECTED {
      set LogString "Client [IP::client_addr]:[TCP::client_port]"
      log local0. "==== $LogString (request) ====="
    }
     
    when SERVER_CONNECTED {
      log local0. "==== $LogString (server connected) - server: [LB::server addr]:[LB::server port] ===="
    }

    • Beaker's avatar
      Beaker
      Icon for Cirrus rankCirrus
      Apr 20, 2020
      when CLIENT_ACCEPTED {
  set LogString "Client [IP::client_addr]"
  log local0. "==== $LogString (request) ====="
}
 
when SERVER_CONNECTED {
  log local0. "==== $LogString (server connected) - server: [LB::server addr]:[LB::server port] ===="
}

      I have tested that this works