Forum Discussion

Rosieodonell_16's avatar
Rosieodonell_16
Icon for Cirrus rankCirrus
Jun 30, 2015

HSL Logging - Filtering it so that you only get the connection information

I have set up the following:

  • Log Filter (emergency severity-source all)
  • Log Destination (pointing to pool that contains splunk server)
  • Log Publisher (points to splunk_db)

I setup the following iRule on the VS:

when CLIENT_ACCEPTED {
    set hsl [HSL::open -proto TCP -pool splunk_9997]
}
when HTTP_REQUEST {
    HSL::send $hsl "Request from external user - [IP::client_addr] to [HTTP::host][HTTP::uri]\n"
}

But when i look at the splunk server i am seeing log data for each png file they are requesting etc. I really just need the initial connection and that is it. Basically i want to see the following:

Request from external user - 172.16.148.2 to www.company.com/etc

Is this possible?

application delivery
BIG-IP Access Policy Manager (APM)
deployment
devops
iRules
LTM
security

1 Reply

  • Arie's avatar
    Arie
    Icon for Altostratus rankAltostratus
    Jun 30, 2015

    You're facing two challenges:

     

    1. Each user may open several connections.
    2. A user may make multiple requests on the same connection.

    You have a number of options to cut down on the log traffic:

     

    1. Log only connections (CLIENT_ACCEPTED). This would of course not log the requests. However, you could set a flag (semaphore) that you can then use it to log the first request in HTTP_REQUEST.
    2. Limit logging to requests without an extension and known pages.