GavinW_29074
Oct 25, 2011Nimbostratus
HSL not working?
Hi there,
I'm trying to set-up an iRule to log-out access logs to a splunk syslog server using HSL.
However I'm having issues with the events not getting to the syslog server...
The iRule is:
when HTTP_REQUEST {
Save Request Side Information
set hsl [HSL::open -proto UDP -pool splunk]
set http_request "\"[HTTP::method] [HTTP::uri] HTTP/[HTTP::version]\""
set http_request_time [clock clicks -milliseconds]
set http_user_agent "\"[HTTP::header User-Agent]]\""
set http_host [HTTP::host]
set http_username [HTTP::username]
set client_ip [IP::remote_addr]
set client_port [TCP::remote_port]
set http_request_uri [HTTP::uri]
set referer "\"[HTTP::header value referer]\""
}
when HTTP_RESPONSE {
set response_time [expr [clock clicks -milliseconds] - $http_request_time]
set timestamp [clock format [clock seconds] -format "%d/%h/%y:%T %Z" -gmt 1 ]
set virtual [virtual]
set content_length 0
if { [HTTP::header exists "Content-Length"] } {
set content_length [HTTP::header "Content-Length"]
}
set lb_server "[LB::server addr]:[LB::server port]"
if { [string compare "$lb_server" ""] == 0 } {
set lb_server ""
}
set status_code [HTTP::status]
set content_type [HTTP::header "Content-type"]
set log_msg ""
append log_msg "virtual=$virtual "
append log_msg "$client_ip "
append log_msg "client_port=$client_port "
append log_msg "lb_server=$lb_server "
append log_msg "$http_host "
append log_msg "$http_username "
append log_msg "\[$timestamp\] "
append log_msg "$http_request_uri "
append log_msg "$http_request "
append log_msg "$status_code "
append log_msg "content_type=$content_type "
append log_msg "$content_length "
append log_msg "resp_time=$response_time "
append log_msg "$referer "
append log_msg "$http_user_agent\n"
log local0. "Sending log to HSL"
HSL::send $hsl $log_msg
}
I can see the 'Sending log to HSL' in the local ltm logs, and on the remote syslog server as the ltm is set to syslog to the same splunk server on a different port.
However the HSL logs never seem to make it... I've tried both TCP and UDP, with no success.
The Splunk pool looks like:
(/Common)(tmos) list ltm pool splunk
ltm pool splunk {
members {
10.0.0.83:printer {
address 10.0.0.83
session monitor-enabled
state up
}
}
monitor tcp
}
And is showing a healthy status in the Gui. Am running LTM on v11 with HF1 applied.
Any ideas???
Cheers
Gavin