For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Jim_M's avatar
Jim_M
Icon for Cirrus rankCirrus
Jul 26, 2019

iRule for logging backend responses

My current connection debugging iRule includes a HTTP_RESPONSE section which makes use of the HTTP::status codes returned by a pool member. However are there any other inclusions i could make to gat...
application delivery
BIG-IP
iRules
Jim_M's avatar
Jim_M
Icon for Cirrus rankCirrus
Jul 26, 2019

The backend web server administrator is saying that his logs are not showing particular requests coming in. The F5 is reporting those requests as being sent. And he reports his server is sending responses to other traffic which differ from what i believe the F5 is receiving. So i am seeking detail of what the F5 is sending and what it is seeing back from the server.

  • JG's avatar
    JG
    Icon for Cumulonimbus rankCumulonimbus
    Jul 26, 2019

    Don't we all have such a problem with an app admin from time to time? 😀

     

    What specific information would you like to log? Do you have a remote log server (as there could be too much to log locally)?

     

    • Jim_M's avatar
      Jim_M
      Icon for Cirrus rankCirrus
      Jul 26, 2019

      I do have a syslog server. A working session generates logs such as:

       

      <134>1 2019-07-26T12:06:20+08:00 DC101VCMP02 info - - - tmm[18608]: Rule /Common/Log_Verbose_Connections <HTTP_REQUEST>: HTTP request received to VIP: 10.70.221.46:443 with URL: quality.mysite.net.au/pay-my-bill.html?p=5192536012

      <134>1 2019-07-26T12:06:20+08:00 DC101VCMP02 info - - - tmm[18608]: Rule /Common/Log_Verbose_Connections <SERVER_CONNECTED>: connected client: 1.127.104.74:59579 to node: 172.21.251.42:818

      1

      <134>1 2019-07-26T12:06:20+08:00 DC101VCMP02 info - - - tmm[18608]: Rule /Common/Log_Verbose_Connections <HTTP_RESPONSE>: HTTP response - Client: 1.127.104.74:59579 -> VIP:10.70.221.46:443

       URL:quality.mysite.net.au/pay-my-bill.html?p=5192536012 -> Node: 172.21.251.42:8181 with response 200

       

      The problem traffic shows up in the log as:

       

      <134>1 2019-07-26T11:41:44+08:00 DC101VCMP02 info - - - tmm[18608]: Rule /Common/Log_Verbose_Connections <HTTP_REQUEST>: HTTP request received to VIP: 10.70.221.46:443 with URL: quality.mysite.net.au/apps/rest/payment/GetDueBalanceDetails_PaymentNumber

      <134>1 2019-07-26T11:42:19+08:00 DC101VCMP02 info - - - tmm[18608]: Rule /Common/Log_Verbose_Connections <HTTP_REQUEST>: HTTP request received to VIP: 10.70.221.46:443 with URL: quality.mysite.net.au/apps/rest/payment/GetDueBalanceDetails_PaymentNumber

       

      There are no corresponding SERVER_CONNECTED or HTTP_RESPONSE entries. A tcpdump does not show the request egressing the F5