Forum Discussion
NimbostratusHSL stopped working
So I'm trying to use HSL to replace our normal logging mechanisms as it appears we are going to significant increase logging.
When I first started testing, things were working fine. Here is the basic rule. There isn't much too it...
when CLIENT_DATA {
TCP::collect
set CLIENTIP [IP::client_addr]
set VIP [IP::local_addr]
set hsl [HSL::open -proto UDP -pool Syslog_NY4]
if { [IP::client_addr] != "208.89.236.196" }{
log local0.info "Connection [IP::client_addr]:[TCP::client_port]<->LTM<->[IP::server_addr]:[TCP::server_port]"
if { [regexp "\x0149=(.*?)\x01" [TCP::payload] -> SenderCompID] } {
HSL::send $hsl "Client IP:$CLIENTIP:Service Name:[virtual name]:VIP address:$VIP:client_port"
} else {
HSL::send $hsl "Client IP:$CLIENTIP:Service Name:[virtual name]:VIP address:$VIP:client_port:No SenderCompID"
}
TCP::release
}
}
I commented out the packet capture and regex to see if it would do simple logging. But it doesn't anymore. Looking at the syslog pool stats, 2 connections were made but nothing else since then.
Is there something I'm missing?
Standard logging is working fine.
5 Replies
- nitass
Employee
I commented out the packet capture and regex to see if it would do simple logging. But it doesn't anymore. Looking at the syslog pool stats, 2 connections were made but nothing else since then. there are more than two client-side tcp connections, aren't they? 
Brian_Gibson_30What do you mean? I commented out one of the HSL logging events. Should have cleaned that up before posting but it isn't doing anything.- nitassWhat do you mean?sorry to confuse. i just want to confirm if CLIENT_DATA event is triggered more than two times. by the way, in addition to checking number of connections on syslog server, can you also check syslog message there? just wondering whether bigip does not send syslog message or it sends but using only two connections.
- Brian_Gibson_30Nitass,
It is only logging once or at least that is what it is supposed to do. When I set this up to log to syslog using the legacy method it works fine.
I do not sethe HSL messages leaving the server. - Brian_Gibson_30Nitass,
It is only logging once or at least that is what it is supposed to do. When I set this up to log to syslog using the legacy method it works fine.
I do not sethe HSL messages leaving the server.
