Forum Discussion
HTTP Policy Logging
I have an HTTP Policy in place with a big of logging. However I'd like to provide more detail in the log such as Client IP Address. I have attempted to use [IP::CLIENT_ADDR] however that doesn't appear to work. Is there away I can accomplish this. Below is my policy:
ltm policy /QA/API_SERVICES {
controls { forwarding }
requires { http }
rules {
"DROP_STATUS PAGES" {
actions {
0 {
log
write
message "[IP::CLIENT_ADDR] ATTEMPT TO ACCESS STATUS PAGE"
}
1 {
forward
reset
}
}
conditions {
0 {
http-uri
path
values { /favorites/status }
}
}
ordinal 2
}
ALLOWED_SERVICES {
actions {
0 {
log
write
message "Attempt to access non-permitted web service"
}
1 {
forward
reset
}
}
conditions {
0 {
http-uri
path
not
starts-with
values { /favorites/ }
}
}
ordinal 3
}
HOST_HEADER {
actions {
0 {
log
write
message "Bad host header."
}
1 {
forward
reset
}
}
conditions {
0 {
http-host
not
values { blah.foo.bar }
}
}
ordinal 1
}
}
strategy /Common/first-match
}
8 Replies
- PK_Bhatia
Nimbostratus
try
"'[IP::client_addr]' ATTEMPT TO ACCESS STATUS PAGE"- sharpie_79656
Nimbostratus
Unfortunately this does not work either.
try
"'[IP::client_addr]' ATTEMPT TO ACCESS STATUS PAGE"- sharpie_79656
Nimbostratus
Unfortunately this does not work either.
- Nicolas_COLLET_
Nimbostratus
Hi,
Apparently, it's need to add tcl to use variable.
I find this example in this article (LTM Policy Recipes) : log write message "tcl:Shellshock detected from [IP::client_addr], blocked"
Best regards
- Stanislas_Piro2
Cumulonimbus
Hi Nicolas,
tcl word must be used in version 12.0 and above.
in version 11.X, tcl is not supported.
- Nicolas_COLLET
Nimbostratus
Hi,
Apparently, it's need to add tcl to use variable.
I find this example in this article (LTM Policy Recipes) : log write message "tcl:Shellshock detected from [IP::client_addr], blocked"
Best regards
- Stanislas_Piro2
Cumulonimbus
Hi Nicolas,
tcl word must be used in version 12.0 and above.
in version 11.X, tcl is not supported.
Help guide the future of your DevCentral Community!
What tools do you use to collaborate? (1min - anonymous)Recent Discussions
Related Content
* Getting Started on DevCentral
* Community Guidelines
* Community Terms of Use / EULA
* Community Ranking Explained
* Community Resources
* Contact the DevCentral Team
* Update MFA on account.f5.com
