For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Robert_47833's avatar
Robert_47833
Icon for Altostratus rankAltostratus
Dec 07, 2011

how to gather how many IPs hit the url and how many times

Hi,dear irule

 

I meet a new requirement recently

 

 

there is an URL: http://cjj.cjj.com/select

 

I wanna gather the stats :

 

how many IPs hit this url: such as ,10.0.0.1 ;10.0.0.2;10.0.0.3

 

how many times per each ip hit this as 10.0.0.1 10 times

 

10.0.0.2 200times

 

10.0.0.3 1times

 

 

 

how to achieve this

 

thanks very much

 

application delivery
dev
devops
iRules

10 Replies

  • Robert_47833's avatar
    Robert_47833
    Icon for Altostratus rankAltostratus
    Dec 07, 2011
    the period may be one month ,it is only the current stats,I need a long term stats

     

    thanks in advance
  • nitass's avatar
    nitass
    Icon for Employee rankEmployee
    Dec 07, 2011
    have you seen table command article by Spark? there are good counting examples there.

     

     

    v10.1 - The table Command - Counting by Spark

     

    http://devcentral.f5.com/Default.aspx?tabid=63&articleType=ArticleView&articleId=2381
  • Robert_47833's avatar
    Robert_47833
    Icon for Altostratus rankAltostratus
    Dec 07, 2011
    hmm,I am not sure whether table command will reslove this

     

    Need to know how many IPs and how many times per Ip hit the url
  • hoolio's avatar
    hoolio
    Icon for Cirrostratus rankCirrostratus
    Dec 07, 2011
    Hi Jucao,

     

     

    I'd actually suggest using High Speed Logging to send a syslog message to a remote (pool of) syslog server(s) and then do your parsing there off of LTM. This will save CPU and memory on LTM. For details on this, see this recent post:

     

     

    Log unique Client Addresses per (Hour|Day|Etc)

     

    http://devcentral.f5.com/Community/GroupDetails/tabid/1082223/aff/5/afv/topic/aft/1184658/afc/1258376/Default.aspx

     

     

    Aaron
  • Hamish's avatar
    Hamish
    Icon for Cirrocumulus rankCirrocumulus
    Dec 08, 2011
    Yes. You can use the tables. But be aware that although the tables are good, keeping stats in there for a month is probably overkill. And you don't need to.

     

     

    What Id' suggest is a balance between using tables and using HSL (Or SIDEBAND connections) to update an external server with the stats. SImilar to the method I used in the LDAP stats counting and reporting iRUles.

     

     

    H
  • nitass's avatar
    nitass
    Icon for Employee rankEmployee
    Dec 09, 2011
    this is counted for 60 seconds. please feel free to revise. 

    [root@ve1023:Active] config  b virtual bar list
virtual bar {
   snat automap
   pool foo
   destination 172.28.19.79:80
   ip protocol 6
   rules myrule
   profiles {
      http {}
      tcp {}
   }
}
[root@ve1023:Active] config  b rule myrule list
rule myrule {
   when CLIENT_ACCEPTED {
        table set -subtable "iplist" [IP::client_addr] "ignored"

        set reqno [table incr "reqs:[IP::client_addr]"]
        table set -subtable "reqrate:[IP::client_addr]" $reqno "ignored" indefinite 60
}

when HTTP_REQUEST {
        if {[string tolower [HTTP::uri]] equals "/stats"} {
                set stats "ip,request number\n"
                foreach ip [table keys -subtable "iplist"] {
                        append stats "$ip,[table keys -count -subtable "reqrate:$ip"]\n"
                }
                HTTP::respond 200 Content $stats
        }
}
}

[root@ve1023:Active] config  curl -i http://172.28.19.79/stats
HTTP/1.0 200 OK
Server: BigIP
Connection: Keep-Alive
Content-Length: 67

ip,request number
172.28.19.80,12
192.168.181.16,5
172.28.19.253,2