Forum Discussion
hsl logging apm
hey,
i have configured this iRule to send syslog message to a remote server with the username and ip that a user gets once starts network access.
i see the log written on the ltm log file however i see no syslog traffic leaving the F5
when CLIENT_ACCEPTED {
ACCESS::restrict_irule_events disable
set hsl [HSL::open -proto UDP -pool PA-IL-SyslogUID]
}
when HTTP_REQUEST {
if { [HTTP::uri] starts_with "/isession?sess=" } {
after 5000 { log local0. "VPN started for [ACCESS::session data get session.logon.last.username] from IP [IP::client_addr] assigned client IP [ACCESS::session data get session.assigned.clientip]"}
HSL::send $hsl "Network Access username:[ACCESS::session data get session.logon.last.username] client-ip:[IP::client_addr] vpn-ip:[ACCESS::session data get session.assigned.clientip]"
}
}
1 Reply
- The-messenger
Cirrostratus
This is an old post, no answers ?
Are you sending data to Splunk?
If so, I see you have what the Splunk docs show for "set hsl". I ended up using the publisher, not "proto UDP -pool .."Reply back if you're still working on this, I'll post my iRule for sending APM data to Splunk.
Help guide the future of your DevCentral Community!
What tools do you use to collaborate? (1min - anonymous)Recent Discussions
Related Content
* Getting Started on DevCentral
* Community Guidelines
* Community Terms of Use / EULA
* Community Ranking Explained
* Community Resources
* Contact the DevCentral Team
* Update MFA on account.f5.com