For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

John_Zammit_459's avatar
John_Zammit_459
Icon for Nimbostratus rankNimbostratus
Mar 14, 2011

iRule logging HTTP/SSL session times

I'm trying to get a script working to log HTTP session times     script I'm running is as follows           ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~       wh...
application delivery
dev
devops
iRules
Michael_Yates's avatar
Michael_Yates
Icon for Nimbostratus rankNimbostratus
Mar 14, 2011
These are a few lines of the log output. They have been sanitized, but it give a basic view of the type of information that the above iRule will provide by default.

It can easily be made to capture more or less information as needed.

Pay close attention to the client IP Address and Port. As you can see below, there are two requests from the same IP Address but on different ports (this is because the IP Address is behind a SNAT, so these are two different user requests on the same Virtual Server). 

 
Mar 14 15:54:27 local/tmm info tmm[4903]: Rule irule.name : (HTTP - Request) Client 192.168.1.100:15251 -> /website/common/scripts/confirmit.js
Mar 14 15:54:27 local/tmm info tmm[4903]: Rule irule.name : (HTTP - Response) Client 192.168.1.100:15251 -> /website/common/scripts/confirmit.js - (Request / Response Delta:  7ms)
Mar 14 15:54:27 local/tmm info tmm[4903]: Rule irule.name : (HTTP - Request) Client 192.168.1.100:15252 -> /website/Style/Scripts/mbox.js
Mar 14 15:54:27 local/tmm info tmm[4903]: Rule irule.name : (HTTP - Response) Client 192.168.1.100:15252 -> /website/Style/Scripts/mbox.js - (Request / Response Delta:  4ms)
Mar 14 15:54:27 local/tmm info tmm[4903]: Rule irule.name : (TCP Connection - Close) Client 192.168.1.100:54635 to 192.168.1.101:80 (Connection Open for:  2068ms)