Forum Discussion

Thanadon_Wattan's avatar
Thanadon_Wattan
Icon for Nimbostratus rankNimbostratus
Jun 07, 2005

how to log all request (not repeated message)

Hi all. I have a problem about logging the HTTP responsed in F5. when there are many requests, the 'ltm' log will says "repeated xxx times" (actually it's not exactly the same message so it shouldn't say "repeated"). I'm logging the request/response in web server. the example is shown below :

 

 

Jun 7 11:07:14 tmm tmm[689]: 01220002:6: Rule crp_rule : crp_test "GET /crptest/images/personalAlbum.gif HTTP/1.1" 200 "SHARP-TQ-GX22" 126 7782

 

Jun 7 11:07:14 tmm tmm[689]: 01220002:6: Rule crp_rule : crp_test "GET /crptest/images/f_item.gif HTTP/1.1" 200 "PANTECH G300" 128 4990

 

Jun 7 11:07:14 tmm tmm[689]: 01220002:6: Rule crp_rule : crp_test "GET /crptest/images/plus_small.gif HTTP/1.1" 200 "SIE-CF62" 127 7635

 

Jun 7 11:07:14 tmm tmm[689]: 01220002:6: Rule crp_rule : crp_test "GET /crptest/images/mainmenu.gif HTTP/1.1" 200 "Nokia3510" 126 4703

 

Jun 7 11:07:14 tmm tmm[689]: 01220002:6: Rule crp_rule : crp_test "GET /crptest/images/nululu.gif HTTP/1.1" 200 "SAGEM-myV-65" 126 12334

 

Jun 7 11:07:17 tmm tmm[689]: 01220002: repeated 234 times

 

 

 

in i-rule, I just write the log only 1 line/request.

 

May anyone help me to find out? why repeated xxx times occur?

 

Thank you in advance.
application delivery
dev
devops
iRules
  • Joe_Pruitt's avatar
    Joe_Pruitt
    Jun 07, 2005
    In v9.x, we are using syslog-ng to perform system logging. The "log" iRule command sends the given string to the local syslog daemon via the "syslog" method. The "repeated xxx times" message is a feature of syslog's automatic output compression. When syslogd sees two or more identical messages bound for the same destination, it outputs the first and then counts (but does not output) the duplicates. After a predetermined delay, it outputs a message of the form "Last message repeated n times" indicating the number of copies received during the delay period.

     

     

    You might want to try to inject some random values into your log messages to verify that indeed you are not logging the same message.

     

     

    I am unaware of any way to turn off the output compression feature of the syslog daemon aside from making sure the messages are unique.

     

     

    -Joe
  • unRuleY_95363's avatar
    unRuleY_95363
    Historic F5 Account
    Jun 14, 2005
    The syslogd isn't the culprit for throttling this message in this case. There is also throttling going on in our error logging system that throttles messages based on their event code (in your case the: 01220002 number). The error logging system is designed to throttle the messages by category and not according to the content. This type of throttling is distinguishable from the repeat suppression that syslogd does by the fact the the repeated message contains the event code.

     

     

    There are two things you can do to disable this throttling:

     

     

    a) set the db variable for rules logging to LOG_DEBUG (which also disables the throttling in the error logging system).

     

    This can be done with the command:

     

    bigpipe db Log.Rules.Level debug

     

     

    b) When you use the iRule command "log" with the facility specified it bypasses the error logging system. So if you use the command as such, it will not be suppressed (except as by syslogd):

     

    log local0. "My message"

     

     

    Hope this helps.
  • unRuleY_95363's avatar
    unRuleY_95363
    Historic F5 Account
    Jun 14, 2005
    On second thought, scratch the approach a) above. The throttling is only disabled if the message itself is a LOG_DEBUG message and the default level for "log" with specifying it is LOG_INFO. The Log.Rules.Level simply indicates what level should be suppressed.

     

     

    So, go with option b) above.