Forum Discussion

BLacaze's avatar
BLacaze
Icon for Altostratus rankAltostratus
Jul 01, 2020

How to access an LTM Policy variable from an iRule ?

Hello, I'm trying to set a variable in an LTM Policy like this:     But then: how can I access this variable from an iRule ?   The only information I find on support site/devcentral is: "...
iRules
LTM
Security
  • Simon_Blakely's avatar
    Simon_Blakely
    Jul 01, 2020

    First, the assignment needs to be [HTTP::method]

    Your irule just needs to reference the connection variable that you assigned in the policy

    when HTTP_REQUEST {
  log local0. "$policy_http_method"
}
Simon_Blakely's avatar
Simon_Blakely
Icon for Employee rankEmployee

First, the assignment needs to be [HTTP::method]

Your irule just needs to reference the connection variable that you assigned in the policy

when HTTP_REQUEST {
  log local0. "$policy_http_method"
}
BLacaze's avatar
BLacaze
Icon for Altostratus rankAltostratus
Jul 02, 2020

Hi Simon,

thanks for your answer, but it still doesn't work. The irule fails with this log message:

Jul  2 07:35:09 f5-1 err tmm[20719]: 01220001:3: TCL error: /Common/syslog_https_test <HTTP_REQUEST> - can't read "policy_http_method": no such variable     while executing "log local0. "$policy_http_method""

This is the beginning of the irule (I copy/pasted the variable name to make sure it's typo free):

when HTTP_REQUEST {
    set http_method ""
    if {[HTTP::has_responded]} {
        log local0. "$policy_http_method"
        set http_method $policy_http_method
    } else {
        set http_method [HTTP::method]
    }

To explain the context:

  • we have a logging irule which role is only to log traffic (you got this right Simon 😉 ) and send them to our syslog server. This irule gets [HTTP:method] and writes it to the log.
  • since we upgraded from v12 to v14, the irule now fails with this error ONLY when trying to log traffic which has been matched by an LTM policy.
Jul  1 16:39:36 f5-1 err tmm2[20719]: 01220001:3: TCL error: /Common/syslog_https_test <HTTP_REQUEST> - Can't call after responding - ERR_NOT_SUPPORTED (line 14)     invoked from within "HTTP::method"

So I feel the only nice way to log this traffic is to pass the value of HTTP::method to the irule. But no luck for now 😞