For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

ywa's avatar
ywa
Icon for Nimbostratus rankNimbostratus
Jul 26, 2021

iRule in system log

Hello,

 

I installed a new BIG-IP VE 15.1.3 appliance and I see some strange behaviour in the logs.

 

In the system log, I have the following line that constantly appears at an interval of 20 mins :

 

...
Mon Jul 26 03:40:01 CEST 2021		bigip.example.com	syslog-ng	)
Mon Jul 26 04:00:01 CEST 2021		bigip.example.com	syslog-ng	)
Mon Jul 26 04:20:01 CEST 2021		bigip.example.com	syslog-ng	)
Mon Jul 26 04:40:01 CEST 2021		bigip.example.com	syslog-ng	)
Mon Jul 26 05:00:01 CEST 2021		bigip.example.com	syslog-ng	)
Mon Jul 26 05:20:01 CEST 2021		bigip.example.com	syslog-ng	)
...

 

And when I update an iRule, the code of the iRule appear in the System log too.

 

For example, if I create a new iRule with this content :

 

when HTTP_REQUEST { 
 if { ! ( [HTTP::header exists "X-Forwarded-Proto" ] ) } {
  HTTP::header insert "X-Forwarded-Proto" "https"
 }
}

 

Then I have the following that appear in the system log : 

 

...
Mon Jul 26 11:23:20 CEST 2021		bigip.example.com	syslog-ng		}" } } [Status=Command OK]
Mon Jul 26 11:23:20 CEST 2021		bigip.example.com	syslog-ng		}
Mon Jul 26 11:23:20 CEST 2021		bigip.example.com	HTTP			:header insert \"X-Forwarded-Proto\" \"https\"
Mon Jul 26 11:23:20 CEST 2021		bigip.example.com	if { ! ( [HTTP		:header exists \"X-Forwarded-Proto\" ] ) } {
...

 

Does someone have an idea why this is happening and if it is possible to avoid this ?

No RepliesBe the first to reply