Forum Discussion

IainThomson85_1's avatar
IainThomson85_1
Icon for Cumulonimbus rankCumulonimbus
Mar 10, 2014

iRule Logging HTTP_REQUEST

I'm having a bit of an issue with an iRule - The issue is that the amount of failures against the iRule is increasing.

 

Many of the requests are passing, >2% are failing.

 

What I think is happening, is the Website that the F5 acts at the load balancer acts for is being subject to site scraping, and the Bots/Robots that are site scraping are not adhering to other iRules in place on the VIP, therefore this rule fails.

 

What i'd like help with if possible is some Logging which will log the Client IP that was associated with the error generated.

 

RULE

 

"rule true_src_rule { when HTTP_REQUEST { HTTP::header insert "True-Client-IP" [getfield [IP::client_addr] "%" 1] } }"

 

Error Example

 

"Mar 10 16:19:48 local/tmm2 err tmm2[6235]: 01220001:3: TCL error: true_src_rule - Operation not supported (line 1) invoked from within "HTTP::header insert "True-Client-IP" [getfield [IP::client_addr] "%" 1]" "

 

application delivery
devops
iRules
  • Cory_50405's avatar
    Cory_50405
    Icon for Noctilucent rankNoctilucent
    Mar 10, 2014

    Are you also doing a redirect in addition to this XFF header addition? That could be the cause of the error.

     

    To simplify, you can just enable insertion of the x-forwarded-for header in the HTTP profile, and you won't need this iRule.

     

  • IainThomson85_1's avatar
    IainThomson85_1
    Icon for Cumulonimbus rankCumulonimbus
    Mar 10, 2014

    Appreciate your comments Cory -

     

    The Client doesn't want to use X-Forward-For header, as their applications can't read it, (Trust me I've tried, and asked a similar question previously)

     

    Which is why I'm having to go down this route.

     

    Regards

     

  • Cory_50405's avatar
    Cory_50405
    Icon for Noctilucent rankNoctilucent
    Mar 10, 2014

    It looks like lots of folks have encountered this error in the past. Have you seen this thread?

     

    https://devcentral.f5.com/questions/error-on-httpheader-insert

     

    Couple of different suggestions to mitigate in here.

     

  • IainThomson85_1's avatar
    IainThomson85_1
    Icon for Cumulonimbus rankCumulonimbus
    Mar 10, 2014

    I have seen this thread, and also rearranged the iRule processing on the F5. In accordance with other solutions/posts

     

    What I would say is if there was fundamentally something wrong with the code I would expect something greater than 2% of failures.

     

  • Cory_50405's avatar
    Cory_50405
    Icon for Noctilucent rankNoctilucent
    Mar 10, 2014

    So does the error still prevent when moving this XFF header insertion iRule to the top of the evaluation list? If so, is the error the same or different?