Forum Discussion

Rafael_255098's avatar
Rafael_255098
Icon for Nimbostratus rankNimbostratus
Mar 28, 2016

How to save only some fields from payload?

Hello,

I need log, in a single line, some informations from Header and some from payload. For this I wrote the iRule below that already saves the header fields correctly, now I need to save only the follow fields from payload, txtLogin and gpnEnviarPor. The others I can discard

How can I do this in a single line?

iRule:

when HTTP_REQUEST
{
   if { ( [string tolower [HTTP::uri]] contains "/resposta/recuperar.php" ) and ( [HTTP::method] equals "POST" ) }
    {
      HTTP::collect [HTTP::header Content-Length]
    }
}

when HTTP_REQUEST_DATA
{
set LogString "Client [HTTP::header X-Forwarded-For]:[TCP::client_port] -> [HTTP::host][HTTP::uri] UserAgent [HTTP::header User-Agent] Referer [HTTP::header Referer]"
set namevals [split [HTTP::payload] "&"]
for {set i 0} {$i < [llength $namevals]} {incr i} {
set params [split [lindex $namevals $i] "="]
log local0. $LogString
log local0. "[lindex $params 0] : [lindex $params 1]"}

}

Payload content:

Mar 28 09:11:52 ASM01P info tmm[16829]: Rule /Common/Collect : ToolkitScriptManager1 : updFiltro%7CbtnLogar
Mar 28 09:11:52 ASM01P info tmm[16829]: Rule /Common/Collect : __LASTFOCUS :
Mar 28 09:11:52 ASM01P info tmm[16829]: Rule /Common/Collect : ToolkitScriptManager1_HiddenField :
Mar 28 09:11:52 ASM01P info tmm[16829]: Rule /Common/Collect : __EVENTTARGET :
Mar 28 09:11:52 ASM01P info tmm[16829]: Rule /Common/Collect : __EVENTARGUMENT :
Mar 28 09:11:52 ASM01P info tmm[16829]: Rule /Common/Collect : txtLogin : 83XXXX85
Mar 28 09:11:52 ASM01P info tmm[16829]: Rule /Common/Collect : txtEmail : C*************%40GMAIL.COM
Mar 28 09:11:52 ASM01P info tmm[16829]: Rule /Common/Collect : gpnEnviarPor : rbtEmail
Mar 28 09:11:52 ASM01P info tmm[16829]: Rule /Common/Collect : txtCarta : 1730*-***
Mar 28 09:11:52 ASM01P info tmm[16829]: Rule /Common/Collect : hdnCPFCNPJ :
Mar 28 09:11:52 ASM01P info tmm[16829]: Rule /Common/Collect : __VIEWSTATE : QWAAmYPZBIBD2YgIBD2QW
Mar 28 09:11:52 ASM01P info tmm[16829]: Rule /Common/Collect : __VIEWSTATEGENERATOR : 734K4001
Mar 28 09:11:52 ASM01P info tmm[16829]: Rule /Common/Collect : __EVENTVALIDATION : %2fVw5DHBkzgQPC
Mar 28 09:11:52 ASM01P info tmm[16829]: Rule /Common/Collect : __ASYNCPOST : true
Mar 28 09:11:52 ASM01P info tmm[16829]: Rule /Common/Collect : btnLogar : Aguarde...

Thanks.

application delivery
iRules
  • Josiah_39459's avatar
    Josiah_39459
    Mar 28, 2016

    Yes, easily. Just add a conditional around this part:

    log local0. $LogString
log local0. "[lindex $params 0] : [lindex $params 1]"

    Like

    if { [lindex $params 0] eq 'txtLogin' or [lindex $params 0] eq 'gpnEnviarPor' } {
    log local0. $LogString
    log local0. "[lindex $params 0] : [lindex $params 1]"
}
  • Josiah_39459's avatar
    Josiah_39459
    Historic F5 Account
    Mar 28, 2016

    Yes, easily. Just add a conditional around this part:

    log local0. $LogString
log local0. "[lindex $params 0] : [lindex $params 1]"

    Like

    if { [lindex $params 0] eq 'txtLogin' or [lindex $params 0] eq 'gpnEnviarPor' } {
    log local0. $LogString
    log local0. "[lindex $params 0] : [lindex $params 1]"
}
    • Rafael_255098's avatar
      Rafael_255098
      Icon for Nimbostratus rankNimbostratus
      Mar 28, 2016
      Thanks Josiah, it works well, but I need to log all information (header and payload) in a single line. Do you know any way to do this?
    • Josiah_39459's avatar
      Josiah_39459
      Historic F5 Account
      Mar 28, 2016
      Yes. If you want to put it in a single line. Instead of "logging" them immediately (which creates new lines), "append" them to a string variable, and then after and outside the for loop, log that single string variable only once.