Forum Discussion
Matt_59095
Aug 18, 2011Nimbostratus
IP to DNS reverse lookup + Geo location? Delimitted format?
LTM 1500 9.4.8
Hi - we'd like to see where our website traffic is coming from, and by which companies. I'd prefer to log that into a format that i can read into a database table, so that i ...
hooleylist
Nov 23, 2011Cirrostratus
You can create an address type data group in the GUI under Local Traffic >> iRules >> Data Group List tab >> Create. Select a type of 'Address' and then add the hosts and/or subnets you want to log for.
Or if you want to log for all clients, you can skip using a datagroup and use an iRule like this:
when CLIENT_ACCEPTED {
Get time for start of TCP connection in milleseconds
set tcp_start_time [clock clicks -milliseconds]
Log the start of a new TCP connection
log local0. "New TCP connection from [IP::client_addr]:[TCP::client_port] to [IP::local_addr]:[TCP::local_port]"
}
when HTTP_REQUEST {
Get time for start of HTTP request
set http_request_time [clock clicks -milliseconds]
Log the start of a new HTTP request
set LogString "Client [IP::client_addr]:[TCP::client_port] -> [HTTP::host][HTTP::uri]"
log local0. "$LogString (request)"
}
when HTTP_RESPONSE {
Received the response headers from the server. Log the pool name, IP and port, status and time delta
log local0. "$LogString (response) - pool info: [LB::server] - status: [HTTP::status] (request/response\
delta: [expr {[clock clicks -milliseconds] - $http_request_time}]ms)"
}
when CLIENT_CLOSED {
Log the end time of the TCP connection
log "Closed TCP connection from [IP::client_addr]:[TCP::client_port] to [IP::local_addr]:[TCP::local_port]\
(open for: [expr {[clock clicks -milliseconds] - $tcp_start_time}]ms)"
}
Aaron
Recent Discussions
Related Content
DevCentral Quicklinks
* Getting Started on DevCentral
* Community Guidelines
* Community Terms of Use / EULA
* Community Ranking Explained
* Community Resources
* Contact the DevCentral Team
* Update MFA on account.f5.com
Discover DevCentral Connects