Forum Discussion

Jim_M's avatar
Jim_M
Icon for Cirrus rankCirrus
Jul 26, 2019

iRule for logging backend responses

My current connection debugging iRule includes a HTTP_RESPONSE section which makes use of the HTTP::status codes returned by a pool member. However are there any other inclusions i could make to gather more detail of the responses received from the nodes being communicated with?

7 Replies

  • JG's avatar
    JG
    Icon for Cumulonimbus rankCumulonimbus

    Would you be able to share the purpose of getting such info, i.e. what problems you are trying to solve?

  • The backend web server administrator is saying that his logs are not showing particular requests coming in. The F5 is reporting those requests as being sent. And he reports his server is sending responses to other traffic which differ from what i believe the F5 is receiving. So i am seeking detail of what the F5 is sending and what it is seeing back from the server.

    • JG's avatar
      JG
      Icon for Cumulonimbus rankCumulonimbus

      Don't we all have such a problem with an app admin from time to time? 😀

       

      What specific information would you like to log? Do you have a remote log server (as there could be too much to log locally)?

       

      • Jim_M's avatar
        Jim_M
        Icon for Cirrus rankCirrus

        I do have a syslog server. A working session generates logs such as:

         

        <134>1 2019-07-26T12:06:20+08:00 DC101VCMP02 info - - - tmm[18608]: Rule /Common/Log_Verbose_Connections <HTTP_REQUEST>: HTTP request received to VIP: 10.70.221.46:443 with URL: quality.mysite.net.au/pay-my-bill.html?p=5192536012

        <134>1 2019-07-26T12:06:20+08:00 DC101VCMP02 info - - - tmm[18608]: Rule /Common/Log_Verbose_Connections <SERVER_CONNECTED>: connected client: 1.127.104.74:59579 to node: 172.21.251.42:818

        1

        <134>1 2019-07-26T12:06:20+08:00 DC101VCMP02 info - - - tmm[18608]: Rule /Common/Log_Verbose_Connections <HTTP_RESPONSE>: HTTP response - Client: 1.127.104.74:59579 -> VIP:10.70.221.46:443

         URL:quality.mysite.net.au/pay-my-bill.html?p=5192536012 -> Node: 172.21.251.42:8181 with response 200

         

        The problem traffic shows up in the log as:

         

        <134>1 2019-07-26T11:41:44+08:00 DC101VCMP02 info - - - tmm[18608]: Rule /Common/Log_Verbose_Connections <HTTP_REQUEST>: HTTP request received to VIP: 10.70.221.46:443 with URL: quality.mysite.net.au/apps/rest/payment/GetDueBalanceDetails_PaymentNumber

        <134>1 2019-07-26T11:42:19+08:00 DC101VCMP02 info - - - tmm[18608]: Rule /Common/Log_Verbose_Connections <HTTP_REQUEST>: HTTP request received to VIP: 10.70.221.46:443 with URL: quality.mysite.net.au/apps/rest/payment/GetDueBalanceDetails_PaymentNumber

         

        There are no corresponding SERVER_CONNECTED or HTTP_RESPONSE entries. A tcpdump does not show the request egressing the F5

  • JG's avatar
    JG
    Icon for Cumulonimbus rankCumulonimbus

    You can also use the event HTTP_REQUEST_SEND to log what is being sent to the app.

  • Hello Jim.

    Better than using an iRule is to set a request-logging profile. It gives you the chance to log a lot of variables from a request and response perspective. Also you can log any http header using "$<header_name>". It's more efficient than other solutions.

    REF - https://techdocs.f5.com/kb/en-us/products/big-ip_ltm/manuals/product/bigip-external-monitoring-implementations-12-1-2/2.html

    KR,

    Dario.