[IP::client_addr] contains source port....

Hello Matthieu,

This is the irule I am using and this one is doing what I expect. Only putting the ip in the client variable

when HTTP_REQUEST { set the URL here, log it on the response set url [HTTP::header Host][HTTP::uri] set vip [IP::local_addr]:[TCP::local_port] set http_request_time [clock clicks -milliseconds] }

when HTTP_RESPONSE { set client [IP::client_addr] set node [IP::server_addr]:[TCP::server_port] set nodeResp [HTTP::status]

log connection info log local0.info "Client:$client -> VIP:$vip $url -> Node:$node with response $nodeResp time_taken:[expr {[clock clicks -milliseconds] - $http_request_time}]" }

So this puts multiple entries in the log where Client: always contains an ipaddress. (like xxx.xxx.xxx.xxx)

This is part of the F5 irule where it most often includes the source port.

when CLIENT_ACCEPTED { set client [IP::client_addr] }

when HTTP_REQUEST { set vhost [HTTP::host]:[TCP::local_port] set url [HTTP::uri] set method [HTTP::method]

snap

when HTTP_RESPONSE { set hsl [HSL::open -proto TCP -pool pool-splunk-logging] set resp_start_time [clock format [clock seconds] -format "%Y/%m/%d %H:%M:%S"] set node [IP::server_addr]:[TCP::server_port] set status [HTTP::status]

if { [HTTP::header Content-Length] > 0 } then {
    set response_length [HTTP::header "Content-Length"]
} else {
    set response_length 0
}

HSL::send $hsl "<190>|$vhost|device_product=Splunk Web Access iRule|$client|$method|\"$url\"|HTTP/$http_version|$user_agent|\"$referer\"|$req_start_time|$req_length|$req_elapsed_time|$node|$status|$resp_start_time|$response_length|$virtual_server\r\n"

}

When this is being send $client is like xxx.xxx.xxx.xxx:yyyyy where yyyyy is the source port.

As the applications is interpreting the $client field as a client the applications is logging 20-30 different clients for one page. While it should only be one client Hope this make sense??

Danny