help with irule to log http and https traffic

What exactly are you looking to log? iRules has the "log" command that will pass the values given to it to syslog.

Here's a simple example of it's usage:

when HTTP_REQUEST {
  log local0. "Request received: Host -> [HTTP::host], URI -> [HTTP::uri]"
}

The client is looking to log http and http connections to the vips and reals to verify persistence. They wanted to use the loadbalncers logging options until I explian that the traffic they are looing for would not be in those logs so will the above irule log http and which vip and real the request gose too ?

 

Try this one:

when HTTP_REQUEST {
   set uri [HTTP::uri]
   set host [HTTP::host]
}
when SERVER_CONNECTED {
   log local0. "[IP::client_addr]:[TCP::client_port] -> [IP::server_addr]:[TCP::server_addr] for http://$host$uri"
}
when LB_FAILED {
   log local0. "[IP::client_addr]:[TCP::client_port] -> FAILED for http://$host$uri"
}

Also note you can change the "local0." to a different facility that you can then configure syslog-ng to route to a different file or even a remote host. You can also configure syslog-ng to route based on some text in the message and leave the facility local0.

 

 

01070151:3: Rule [http_traffic_log] error:

 

line 6: [undefined procedure: TCP::server_addr] [TCP::server_addr]

 

 

 

 

Properties

 

Name

 

Definition

 

when HTTP_REQUEST {

 

set uri [HTTP::uri]

 

set host [HTTP::host]

 

}

 

when SERVER_CONNECTED {

 

log local0. "[IP::client_addr]:[TCP::client_port] -> [IP::server_addr]:[TCP::server_addr] for http://$host$uri"

 

}

 

when LB_FAILED {

 

log local0. "[IP::client_addr]:[TCP::client_port] -> FAILED for http://$host$uri"

 

}

 

Extend Text Area

 

Wrap Text

 

please help ne to irules and ithe above rule errored out. Thanks

 

TCP::server_port , not TCP::server_addr .

ok really stupid how do I apply it ???

We worked on Syslog-ng for a log time to get it to send e-mail out from the unit when when certin iRules log information. What we found out is you can not add new facilities to syslog due to the fact they are aready defined in RFC 3164. Because of this the only why we found to get syslog to do what we want was to setup regex on local0. and then push it to another log file of to the e-mail program.

Posted By atase on 12/17/2005 7:43 PM

 

 

ok really stupid how do I apply it ???

 

 

Replace TCP::server_addr with TCP::server_port in your iRule. Is that what you were asking? I'm not exactly sure what you meant by "apply it"...

 

 

-Joe