Forum Discussion
Jeffrey_Silver1
Nimbostratus
NimbostratusI need an irule to log HTTP traffic to SPLUNK to capture the originating IP address before it get's NAT'd
I need to capture original IP addresses for HTTP traffic that passes through an F5 LTM then get's NAT'd. I've read several posts but I am not exactly sure where to begin. I am running 10.2.4.
Kevin_Stewart
Employee
EmployeeI take it you're looking for a logging function - sending the data to Splunk. The X-Forwarded-For option is for inserting an HTTP header in the request to the application server. You can certainly use the [IP::client_addr] command in mostly any of the client side events (ie. CLIENT_ACCEPTED, HTTP_REQUEST, etc.), and you'll most likely also want to do this with High Speed Logging in lieu of standard "log local" functions:
https://devcentral.f5.com/wiki/iRules.HSL__send.ashx
If you can move up to (at least) 11.1, you can also just build a request logging profile and completely skip the iRules:
