Help for when_http_response

Question

&nbsp;

&nbsp;
when HTTP_REQUEST timing on priority 100 {&nbsp;
 Check the requested path with wildcard matching&nbsp;
                switch -glob [HTTP::path] {&nbsp;
                                "/appmania*" {&nbsp;
          log local0. "HOST [HTTP::host] PATH [HTTP::path]"&nbsp;
         pool HTTP_appmania&nbsp;
                }&nbsp;
                                "/floo*" {&nbsp;
          log local0. "HOST [HTTP::host] PATH [HTTP::path]"&nbsp;
         pool HTTP_floo&nbsp;
                }&nbsp;
                                "/HARDWARE*" {&nbsp;
                      switch [string tolower [IP::client_addr]] {&nbsp;
                                                               "85.88.99.201" {&nbsp;
                                   log local0. "1 [HTTP::uri] [IP::client_addr] "&nbsp;
                                                                  pool HTTP_active&nbsp;
                                   log local0. " [HTTP::uri] [IP::client_addr] "&nbsp;
                                                               }&nbsp;
                                                               "85.87.66.78" {&nbsp;
                                   log local0. "1 [HTTP::uri] [IP::client_addr] "&nbsp;
                                                                    pool HTTP_active&nbsp;
                                   log local0. " [HTTP::uri] [IP::client_addr] "&nbsp;
                                                               }&nbsp;
                                                               "85.74.86.89" {&nbsp;
                                   log local0. "1 [HTTP::uri] [IP::client_addr] "&nbsp;
                                                                    pool HTTP_active&nbsp;
                                   log local0. " [HTTP::uri] [IP::client_addr] "&nbsp;
                                                               }&nbsp;
                                                               "92.78.96.129" {&nbsp;
                                   log local0. "1 [HTTP::uri] [IP::client_addr] "&nbsp;
                                                                    pool HTTP_active&nbsp;
                                   log local0. " [HTTP::uri] [IP::client_addr] "&nbsp;
                                                               }&nbsp;
                                                               "92.78.96.129" {&nbsp;
                                   log local0. "1 [HTTP::uri] [IP::client_addr] "&nbsp;
                                                                    pool HTTP_active&nbsp;
                                   log local0. " [HTTP::uri] [IP::client_addr] "&nbsp;
                                                               }&nbsp;
                               default&nbsp;
                               {&nbsp;
                                                    pool HTTP_active&nbsp;
                               }&nbsp;
                                                }&nbsp;
          log local0. "HOST [HTTP::host] PATH [HTTP::path]"&nbsp;
         log local0. " [HTTP::uri] [IP::client_addr] "&nbsp;
           pool HTTP_active&nbsp;
                }&nbsp;

&nbsp;
&nbsp;
I need your help about the above irule.  we want to produce log the "/HARDWARE*" { responses on the f5. Could you help us ?&nbsp;
Thank you in advance.&nbsp;
regards, &nbsp;

&nbsp;

nitass · Answer

we want to produce log the "/HARDWARE*" { responses on the f5. what information would you like to log in response?

nitass · Answer

we want to produce log the "/HARDWARE*" { responses on the f5. what information would you like to log in response?

hoolio · Answer

A few comments: 
&nbsp;  
&nbsp; You can remove the 'string tolower' command on the client IP address as IPv4 addresses don't have alpha characters.   
&nbsp;  
&nbsp; You could add the IP addresses to a data group and then use the class command to look up the client IP against the data group.  This should be simpler and more efficient than using the a switch statement to do a string comparison of the IP addresses. 
&nbsp;  
&nbsp; Aaron

waterfall_10467 · Answer

Hello All, &nbsp;
&nbsp; Thank you for your quick reply.Actually. this irule is longer but I have cut a part of it relevant to us.And I have to run it right away .That's why I can consider the data group for later. Nitass , after client's request I need to collect all responses of servers. Because we want to observe if client connect  to server successfully.However, since the irule will consist heavy load on the f5. I want to this only for a project to troubleshoot. when the project finished. I will send all the logs to syslog sever.and this topic really very urgent for us.&nbsp;
&nbsp; thank you for your helps

nitass · Answer

is this codeshare applicable? 
  
 HTTP Payload Collection by Deb 
 https://devcentral.f5.com/wiki/iRules.HTTPPayloadCollection.ashx 
  
 e.g. 
  
 [root@ve10:Active] config  b virtual bar list
virtual bar {
   snat automap
   destination 172.28.19.79:80
   ip protocol 6
   rules myrule
   profiles {
      http {}
      tcp {}
   }
}
[root@ve10:Active] config  b rule myrule list
rule myrule {
   when HTTP_REQUEST {
   set flag 0
   set path [HTTP::path]
   switch -glob $path {
      "/HARDWARE*" {
         set flag 1
         set collected 0
         if { [HTTP::version] eq "1.1" } {
            if { [HTTP::header is_keepalive] } {
               HTTP::header replace "Connection" "Keep-Alive"
            }
            HTTP::version "1.0"
         }
         pool HTTP_active
      }
      default {
          do someting
      }
   }
}

when HTTP_RESPONSE {
   if {$flag == 0} { return }

if { [HTTP::header exists "Content-Length"] } {
      set content_length [HTTP::header "Content-Length"]
   } else {
      set content_length 0
   }
   if { $content_length &gt; 0 &amp;&amp; $content_length &lt; 1048577 } {
      set collect_length $content_length
   } else {
      set collect_length 1048576
   }
   if { $collect_length &gt; 0 } {
      HTTP::collect $collect_length
   }
}

when HTTP_RESPONSE_DATA {
   log local0. "client [IP::client_addr]:[TCP::client_port] | server [IP::remote_addr]:[TCP::remote_port] | path $path | payload [HTTP::payload]"
   HTTP::release

set collected [expr {$collected + $collect_length}]
   set remaining [expr {$content_length - $collected}]
   if { $remaining &gt; 0 } {
      if { $remaining &lt; $collect_length } {
         set collect_length $remaining
      }
      HTTP::collect $collect_length
   }
}
}

[root@ve10:Active] config  tail -f /var/log/ltm
Jul 20 21:02:20 local/tmm info tmm[5111]: Rule myrule : client 192.168.206.55:51246 | server 200.200.200.101:80 | path /HARDWARE/test.html | payload hello world

Forum Discussion

Help for when_http_response

7 Replies

Recent Discussions

Errors with AS3 3.56.0 with F5 17.5.1.6

F5 ASM/AWAF – violations logged but no learning suggestions generated

F5 VELOS Backplane Inter-Tenants Communication

migrate from serie I to R. Cluster LTM-GTM

Best Practice guide for enabling Attack signature In BIG-IP ASM

Related Content

http health monitoring using iRules