Forum Discussion
hooleylist
Aug 21, 2009Cirrostratus
The value for HTTP::uri is cached within the same event and event priority. If you want to see the effect of the change, you can add a second HTTP_REQUEST event that runs after your change is made with a log statement. Once you're okay with the test, you can comment out/remove the debug event.
when HTTP_REQUEST priority 501 {
log local0. "[IP::client_addr]:[TCP::client_port] (501): \[HTTP::uri\]: [HTTP::uri]"
}
Aaron