Forum Discussion

Mike_73765's avatar
Icon for Nimbostratus rankNimbostratus
Nov 17, 2010

Irule for remote logging

Hey guys,




I have a one are configuration, and I want to log each connection to a syslog server. I want to log client ip address along with node ip address. I'm assuming I'll have to use 2 events, http_request and lb_selected.



Could someone please help me out with the syntax?






7 Replies

  • Hi Mike,

    If you're on 10.1+ you could use the HSL commands and log a single entry in SERVER_CONNECTED when LTM establishes a connection with the pool member. Here's an untested example:

       set hsl [HSL::open -proto UDP -pool syslog_server_pool]
        Log HTTP request via syslog protocol as; see RFC 3164 for more info
       HSL::send $hsl "<190> Client: [IP::client_addr]:[TCP::client_port], VS: [clientside {IP::local_addr}][clientside {TCP::local_port}], SNAT: [IP::local_addr]:[TCP::local_port], Pool member [IP::server_addr]:[TCP::server_port]"

    Else, if you're on 9.4.0 - 10.0.x, you could use log -remote to send the messages to a remote syslog server without going through the local syslog-ng daemon:

    log command wiki page:

    iRules Update: New options for the "log" command

  • Thanks Aaron.



    Here's what i have so far. How can i concatenate this information from the 2 events into one log message that is sent to the syslog server, per connection?






    log "Client Connected, IP: [IP::client_addr]"






    log "And Pool member [IP::server_addr]:[TCP::server_port]"


  • Sure: [IP::client_addr] is available any time after the connection from the client to the VS is established:

       log "Client: [IP::client_addr], Pool member [IP::server_addr]:[TCP::server_port]"

    Also, if you're already SNAT'ing all of the serverside traffic you should consider adding a default OneConnect profile to the virtual server to re-use the serverside connections and reduce LTM and server load.

  • Everyone is writing the irule but none of them telling what this irule is used for and how to implement it. The usage is very important
  • Hi sprashanthac,



    See my reply here:





  • Thanks Aaron. This one is a good solution for HSL logging. will try this and get back on more issues. Seems like I need more detailed way of logging set up for each type of log. Will post the question.