Forum Discussion

Ajinkya

Altostratus

May 06, 2021

How to log more specific traffic in irule

Hi All,

I need help in logging the irule traffic.

I have i-rule, in which "switch" statement is used to redirect traffic to different pool.

there are 100+ URIs used under this statement for redirection as below;

switch -glob [ HTTP::uri ] {

"/abc/123/abc.html" {pool HTTP_POOL_1}

"/abd/124/abc.html" {pool HTTP_POOL_3}

"/abe/125/abc.html" {pool HTTP_POOL_6}

"/abf/126/abc.html" {pool HTTP_POOL_2}

"/abg/127/abc.html" {pool HTTP_POOL_4}

"/abh/128/abc.html" {pool HTTP_POOL_6}

"/abi/129/abc.html" {pool HTTP_POOL_7}

100+

}

my requirement is to log the traffic for only for "/abg/127/abc.html {pool HTTP_POOL_4}" with client IP. It should not log the traffic with other URIs.

Can anyone please help me with this?

application delivery

iRules

AlexBCT
May 06, 2021
Hi Ajinkya,

I think the following should work:

"/abg/127/abc.html" {
pool HTTP_POOL_4
log local0. "URI /abg/127/abc/html matched. Client IP [IP::client_addr]"
}

If you have a look here, there is a good explanation of the "switch" command, as well as some examples on what it can look like: https://clouddocs.f5.com/api/irules/switch.html

Additionally, if you indeed have a 100+ entries in the switch statement, you may want to have a look at working with DataGroups, rather than the switch statement - it can improve performance quite a bit (if performance is a factor of course) You can find more info about this here: https://clouddocs.f5.com/api/irules/class.html

Hope this helps.

AlexBCT
Cumulonimbus
May 06, 2021
Hi Ajinkya,

I think the following should work:

"/abg/127/abc.html" {
pool HTTP_POOL_4
log local0. "URI /abg/127/abc/html matched. Client IP [IP::client_addr]"
}

If you have a look here, there is a good explanation of the "switch" command, as well as some examples on what it can look like: https://clouddocs.f5.com/api/irules/switch.html

Additionally, if you indeed have a 100+ entries in the switch statement, you may want to have a look at working with DataGroups, rather than the switch statement - it can improve performance quite a bit (if performance is a factor of course) You can find more info about this here: https://clouddocs.f5.com/api/irules/class.html

Hope this helps.
Ajinkya
Altostratus
May 07, 2021
Hi Alex,
It is working!!!😃

Thanks you so much for your help and also for sharing useful links!!
- AlexBCT
  Cumulonimbus
  May 07, 2021
  Great to hear!
  Would be great if you can flag the above solution as an answer, so the thread can be closed and may help others with the same problem.