High Speed Logging event correlation

You could try something like this, but I haven't tested it myself yet. when HTTP_REQUEST { set hsl [HSL::open -proto UDP -pool ] set ID [md5 "[clock seconds][IP::client_addr][TCP::client_port]"] HSL::send $hsl "$ID,[clock format [clock seconds] -gmt],[IP::client_addr],[TCP::client_port],[HTTP::request]" } when HTTP_RESPONSE { HSL::send $hsl "$ID,[clock format [clock seconds] -gmt],[IP::client_addr],[TCP::client_port],[HTTP::status]" }

As part of the output cycle of the profile, it appears that there are groups of request and response entries. Can you tell me if all request and response are tied together? Meaning, when I see a request from a specific client, is it always true that the next response from that client is related to the immediately previous request.

That's not guaranteed when using HSL... order of delivery is not preserved. Even if using TCP with HSL, you can get multiple connections and HSL uses the first available (or if it would have to queue, then it'll open new connection). Umm... Is request number available in the logging profile template? Hold on... No they're not... At least in 11.1 (I can't fin the template for 11.6 ATM, but I don't think it's changed anyway). However request_number IS available in an iRule [HTTP::request_num] that's unique for a connection... So if you log the client IP and tcp port and the request num, that should be unique for a few minutes at least (Until the client re-uses the src port which SHOULD be at least 2 minutes). You can tie up a request with a response there. But if you just log everything on the response (In an iRule), you won't even have that problem... If it's info that's only available on the request, just save it in the iRule HTTP_REQUEST event, and reference it in the HTTP_RESPONSE event. Back to a log profile however, you CAN log arbitrary headers... So if there's a header that has a session ID in it you could log that... (Undelineated strings return the value of the respective header. - this is documented in 11.1, so should be available in pretty much all versions) H