For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Tiaan_92076's avatar
Tiaan_92076
Icon for Nimbostratus rankNimbostratus
Aug 18, 2009

How to determine last segment in reaseembled TCP packet

I need to detach the load balancing decision after a transaction is completed on a member in the pool. The transaction occasionally spans multiple TCP segments causing the SERVER_DATA event to be rais...
application delivery
dev
devops
iRules
hoolio's avatar
hoolio
Icon for Cirrostratus rankCirrostratus
Feb 23, 2010
The is probably from syslog-ng suppressing duplicate messages:

 

 

http://devcentral.f5.com/wiki/default.aspx/iRules/log

 

 

...syslog-ng will still perform suppression of repeated duplicates.

 

 

 

From the syslog-ng v2.0 manual, there is a suppress option which will summarize all duplicate messages within an interval. By default this is disabled though. And I couldn't find anywhere in the default syslog-ng.conf or 'b syslog list all' output where it is configured. But I have seen this suppression consistently when logging duplicate messages in quick succession.

 

 

 

http://www.balabit.com/dl/guides/syslog-ng-v2.0-guide-admin-en.pdf

 

 

Name: suppress()

 

Type: seconds

 

Default: 0 (disabled)

 

Description:

 

 

When enabled and syslog-ng would send several messages

 

with identical content to the destination, syslog-ng sends only

 

a single message and a line Last message repeated n

 

times.. The parameter of this option specifies the number of

 

seconds syslog-ng waits for identical messages.

 

 

 

 

Aaron