Forum Discussion
Benito_322567
Nimbostratus
NimbostratusProblem with logging balanced (UDP) to multiple syslog servers
I've a problem with logging balanced (UDP) to multiple syslog servers.
Setup in a nutshell:
iRule(HSL-publisher) --> LogPublisher --> LogDestination(UDP, balanced) --> Pool (Round_Robin) with m...
Volker_95568Nimbostratus
NimbostratusHi,
my iRule only logs Request and Responses. I pick the connection information from the environment of the HTT_Request/Response.
The iRule (jsession) is inside the following BigIP Settings:
My default persistence profile is based on the "cookie" profile.
I added "httpclass" and "oneconnect".
Last but not least I configured my own "http" profile.
This is the iRule to log events and pick up the cookie. The persist is just inserted by me, its not usable, because there should be
2 iRules, (if it could not be handled implicit by the configuration.)
1. iRule reacting on the HTTP_REQUEST by storing connection information.
2. iRule reaction on the HTTP_RESPONSE by reading connection information.
when HTTP_REQUEST {
set pers_cookie [HTTP::cookie "JSESSIONID"]
set destination [IP::remote_addr]
set source [IP::local_addr]
set d_port [TCP::remote_port]
set s_port [TCP::local_port]
log local0. "Connection $source:$s_port <- $destination:$d_port, Cookie:$pers_cookie"
if { [HTTP::cookie exists "JSESSIONID"] } {
persist uie [HTTP::cookie "JSESSIONID"]
} else {
set jsess [findstr [HTTP::uri] "JSESSIONID" 11 ";"]
if { $jsess != "" } {
persist uie $jsess
}
}
}
when HTTP_RESPONSE {
set pers_cookie [HTTP::cookie "JSESSIONID"]
set destination [IP::remote_addr]
set source [IP::local_addr]
set d_port [TCP::remote_port]
set s_port [TCP::local_port]
log local0. "Connection $source:$s_port -> $destination:$d_port, Cookie:$pers_cookie"
if { [HTTP::cookie exists "JSESSIONID"] } {
persist add uie [HTTP::cookie "JSESSIONID"]
} else {
set jsess [findstr [HTTP::payload] "JSESSIONID" 11 ";"]
if { $jsess != "" } {
persist uie $jsess
log local0. "Findstr cookie $source:$s_port <- $destination:$d_port, Cookie:$jsess"
}
}
}
Pierce_FortinI wrongly understood how cookies were formatted. This works for me:
when HTTP_RESPONSE { set cookies [HTTP::cookie names] foreach cookie $cookies { set cookie_value [HTTP::cookie $cookie] set cookie_path [string map -nocase {"/" "/FOO-BAR/"} [HTTP::cookie path $cookie]] HTTP::cookie remove $cookie HTTP::cookie insert name Special-Name value $cookie_value path $cookie_path } }
![\"F5](\"https://www.f5.com/content/dam/f5/f5-logo.svg\"){kind=logo}
