Forum Discussion
Dor
Mar 24, 2020Nimbostratus
hsl logging apm
hey,
i have configured this iRule to send syslog message to a remote server with the username and ip that a user gets once starts network access.
i see the log written on the ltm log file however i see no syslog traffic leaving the F5
when CLIENT_ACCEPTED {
ACCESS::restrict_irule_events disable
set hsl [HSL::open -proto UDP -pool PA-IL-SyslogUID]
}
when HTTP_REQUEST {
if { [HTTP::uri] starts_with "/isession?sess=" } {
after 5000 { log local0. "VPN started for [ACCESS::session data get session.logon.last.username] from IP [IP::client_addr] assigned client IP [ACCESS::session data get session.assigned.clientip]"}
HSL::send $hsl "Network Access username:[ACCESS::session data get session.logon.last.username] client-ip:[IP::client_addr] vpn-ip:[ACCESS::session data get session.assigned.clientip]"
}
}
- The-messengerCirrostratus
This is an old post, no answers ?
Are you sending data to Splunk?
If so, I see you have what the Splunk docs show for "set hsl". I ended up using the publisher, not "proto UDP -pool .."Reply back if you're still working on this, I'll post my iRule for sending APM data to Splunk.
Recent Discussions
Related Content
DevCentral Quicklinks
* Getting Started on DevCentral
* Community Guidelines
* Community Terms of Use / EULA
* Community Ranking Explained
* Community Resources
* Contact the DevCentral Team
* Update MFA on account.f5.com
Discover DevCentral Connects