I got the message in Irule ( undefined procedure: ) and [use curly braces to avoid double substitution]

1) Error line 8:

01070151:3: Rule [test] error: line 8: [undefined procedure: table] [table lookup -subtable "blacklist" $srcip]

Important to note that subtables were introduced in v10.1. This function would not work in case of v9. Since it appears your iRule syntax is correct, I assume the error is from LTM < v10.1 (older than), and the cause is that the function is not supported.

2) Errors line 13 and 16:

line 13: [use curly braces to avoid double substitution] [[clock second]] line 16: [use curly braces to avoid double substitution] [$static::interval]

In regards to this particular error, try enclosing the expr function in curly braces. Possible there are more problems with your iRule, but first lets see if this suggestion will get you somewhere.

   Instead of: 
  set intervaltime [expr [clock second] / $static::interval]
   Use:
  set intervaltime [expr { [clock second] / $static::interval } ]

   Instead of:
  table lifetime $key [expr $static::interval + 1]
   Use:
  table lifetime $key [expr { $static::interval + 1 } ]

Please mark the answer as accepted if you believe it's correct.

when RULE_INIT { set static::maxquery 3 set static::holdtime 30 set static::interval 3 } when HTTP_REQUEST { set srcip [IP::remote_addr] if { [table lookup -subtable "blacklist" $srcip] != "" } { drop log local1. "continous drop : ClientIP=[IP::remote_addr]" return } set intervaltime [expr [clock second] / $static::interval] set key "count:$srcip:$intervaltime" set count [table incr $key] table lifetime $key [expr $static::interval + 1] log local1. "nowtime=[clock second] / intervaltime=$intervaltime / ClientIP=[IP::remote_addr]" if { $count >= $static::maxquery } { table add -subtable "blacklist" $srcip "blocked" indef $static::holdtime table delete $key drop log local1. "nowtime=[clock second] / intervaltime=$intervaltime / ClientIP=[IP::remote_addr] / initial drop : [IP::remote_addr]" return } }