Forum Discussion

Log4j2's avatar
Log4j2
Icon for Altocumulus rankAltocumulus
May 10, 2022

iRule [string range...] not chunking data properly

I have an irule (much of which I found here) that is to gather some much needed troubleshooting data I need in regards to the headers and payload I have coming in.  The payload is obvisouly too large...
chunk
event
irule
payload
splitting
tcl
  • PeteWhite's avatar
    PeteWhite
    May 11, 2022

    In fact I have just grabbed this from an iRule i recently wrote. Almost the same, with fixed values. Note the end is 99 but the increment is 100. As you say, string range is zero-indexed

    for {set start 0; set end 99} {$start < [HTTP::payload length]} {incr start 100;incr end 100} {
            log local0.debug "[string range [HTTP::payload] $start $end ]"
        }
Nikoolayy1's avatar
Nikoolayy1
Icon for MVP rankMVP
May 11, 2022

This sounds like the limit "900" that is set in the static variable because of F5 limit "The syslog facility is limited to logging 1024 bytes per request. Longer strings will be truncated."  . You may increase the limit static:max_chars to 1024 as each character is 8 bits (1 Byte) and it seems to me that this is your issue and also try using HSL remote logging to your syslog server or SIEM like splunk/elk/qradar etc. without logging locally as then maybe the limit of 1024 will not apply.

 

 

https://clouddocs.f5.com/api/irules/log.html

Also you play a little with the F5 HTTP profile and the chrunking to see if it helps changing it to the different modes:

https://support.f5.com/csp/article/K5379

 

  • Log4j2's avatar
    Log4j2
    Icon for Altocumulus rankAltocumulus
    May 11, 2022

    So I increased the max_char value to 1024 but I'm still getting the same issue, just more data in the first chunk.

    This time I've splatted the response to properly represent how many characters I'm actually getting back:

    chunk1

xxxx_xxx=<xxxxxxxxxxx> <xxxxxxx>xxxx_xxxxxx</xxxxxxx> <xxxxxxx>xxxx://xxxx_xxx</xxxxxxx> <xxxxxxxxxxxxxxxxxxxx>x2xx37xx-0x94-4xx4-x70x-3xx74xx1x075</xxxxxxxxxxxxxxxxxxxx> <xxxxxxx>1.7</xxxxxxx> <xxxxxxxxxxxxxx>${xxxxxxxxxxxxxx}</xxxxxxxxxxxxxx> <xxxxxxxxxxx>100</xxxxxxxxxxx> <xxxxxxxxxx>100x</xxxxxxxxxx> <xxxxxxxxxxxxxx>12345678</xxxxxxxxxxxxxx> <xxxxxxxxxxxxxxx>x</xxxxxxxxxxxxxxx> <xxxxxxxxxxx>xxxx xxxxxxxxxxxx x - xxxx_xxxxxx-91</xxxxxxxxxxx> <xxxxxx>69420</xxxxxx> <xxxxxxxxxxxx>840</xxxxxxxxxxxx> <xxxxxxxxxx>4000000000001000</xxxxxxxxxx> <xxxxxxxxxxxx>01</xxxxxxxxxxxx> <xxxxxxxxxxx>2021</xxxxxxxxxxx> <xxxxxxxxxxxxxxxx>xxxx</xxxxxxxxxxxxxxxx> <xxxxxxxxxxxxxxxxx>x</xxxxxxxxxxxxxxxxx> <xxxxxxxxxxxxxxx>xxx</xxxxxxxxxxxxxxx> <xxxxxxxxxxxxxx1>1600 xxxxxxxxxxxx xxxx.</xxxxxxxxxxxxxx1> <xxxxxxxxxxxxxx2/> <xxxxxxxxxxxx>555-8675-309</xxxxxxxxxxxx> <xxxxxxxxxxx>xx
    chunk2

xxxx/3.1</xxxxxxxxx> <xxxxxxxxxxxxx>xxxx/xxxx,xxxxxxxxxxx/xxxxx+xxx,xxxxxxxxxxx/xxx;x=0.9</xxxxxxxxxxxxx> <xxxxxxxxxxxxx>xxx</xxxxxxxxxxxxx> //<xxxxxxxxxx>01</xxxxxxxxxx> <xxxxxxxxxxxxxxxxxxxxxxxx>03</xxxxxxxxxxxxxxxxxxxxxxxx> <xxxxxxxxxxxxxxxxxxx>01,02</xxxxxxxxxxxxxxxxxxx> <xxxxxxxx>xxx64xxx-x19x-4728-8849-x3x50xxxxx39</xxxxxxxx> <xxxxxxxxxxxxx>${xxxxxxxxxxx}</xxxxxxxxxxxxx> <xxxxxxxxxxx>12341234</xxxxxxxxxxx> <xxxxxxxxxxxxx>xxxxxxxx</xxxxxxxxxxxxx> </xxxxxxxxxxx>

     

    My original request is like so:

    xxxx_xxx=<xxxxxxxxxxx>
	<xxxxxxx>xxxx_xxxxxx</xxxxxxx>
	<xxxxxxx>xxxx://xxxx_xxx</xxxxxxx>
	<xxxxxxxxxxxxxxxxxxxx>${xxxxxxxxxxxxxxxxxxxx}</xxxxxxxxxxxxxxxxxxxx>
	<xxxxxxx>1.7</xxxxxxx>
	<xxxxxxxxxxxxxx>${xxxxxxxxxxxxxx}</xxxxxxxxxxxxxx>
	<xxxxxxxxxxx>${xxxxxxxxxxx}</xxxxxxxxxxx>
	<xxxxxxxxxx>${3xx-xxx-xxxxxxxxxx}</xxxxxxxxxx>
	<xxxxxxxxxxxxxx>${xxxxxxxxxxx}</xxxxxxxxxxxxxx>
	<xxxxxxxxxxxxxxx>x</xxxxxxxxxxxxxxx>
	<xxxxxxxxxxx>${__xxxxxxxxxxx()}-${__xxxxxx(0,99)}</xxxxxxxxxxx>
	<xxxxxx>69420</xxxxxx>
	<xxxxxxxxxxxx>840</xxxxxxxxxxxx>
	<xxxxxxxxxx>1234567891012345</xxxxxxxxxx>
	<xxxxxxxxxxxx>01</xxxxxxxxxxxx>
	<xxxxxxxxxxx>2021</xxxxxxxxxxx>
	<xxxxxxxxxxxxxxxx>xxxx</xxxxxxxxxxxxxxxx>
	<xxxxxxxxxxxxxxxxx>x</xxxxxxxxxxxxxxxxx>
	<xxxxxxxxxxxxxxx>xxx</xxxxxxxxxxxxxxx>
	<xxxxxxxxxxxxxx1>1600 xxxxxxxxxxxx xxxx.</xxxxxxxxxxxxxx1>
	<xxxxxxxxxxxxxx2/>
	<xxxxxxxxxxxx>555-8675-309</xxxxxxxxxxxx>
	<xxxxxxxxxxx>xxxxxxxxxx</xxxxxxxxxxx>
	<xxxxxxxxxxxx>xx</xxxxxxxxxxxx>
	<xxxxxxxxxxxxxxxxx>10123</xxxxxxxxxxxxxxxxx>
	<xxxxxxxxxxxxxxxxxx>xx</xxxxxxxxxxxxxxxxxx>
	<xxxxxxxxxxxxxxxxx>xxxxxxx</xxxxxxxxxxxxxxxxx>
	<xxxxxxxxxxxxxxxx/>
	<xxxxxxxxxxxxxxx1>1600 xxxxxxxxxxxx xxxx.</xxxxxxxxxxxxxxx1>
	<xxxxxxxxxxxxxxx2/>
	<xxxxxxxxxxxxx>555-123-4568</xxxxxxxxxxxxx>
	<xxxxxxxxxxxx>xxxxxxxxxx</xxxxxxxxxxxx>
	<xxxxxxxxxxxxx>xx</xxxxxxxxxxxxx>
	<xxxxxxxxxxxxxxxxxx>10123</xxxxxxxxxxxxxxxxxx>
	<xxxxxxxxxxxxxxxxxxx>xx</xxxxxxxxxxxxxxxxxxx>
	<xxxx_xxxx_1>xxxx</xxxx_xxxx_1>
	<xxxx_xxxx_1>xxxxx xxxx</xxxx_xxxx_1>
	<xxxx_xxxxx_1>10000</xxxx_xxxxx_1>
	<xxxx_xxxxxxxx_1>1</xxxx_xxxxxxxx_1>
	<xxxx_xxx_1>8675309</xxxx_xxx_1>
	<xxxxxxxxxxxx>1234</xxxxxxxxxxxx>
	<xxxxxxxxxxxxxxx>01</xxxxxxxxxxxxxxx>
	<xxxxxxxxxxxxxxx>xxxxxxx</xxxxxxxxxxxxxxx>
	<xxxxxxxxxxxxxxxxx>500</xxxxxxxxxxxxxxxxx>
	<xxxxxxxxxxxxxxxxxxx>980</xxxxxxxxxxxxxxxxxxx>
	<xxxxxxxxxxxxxxxxxx>1080</xxxxxxxxxxxxxxxxxx>
	<xxxxxxxxxxxxxxx>-1:00</xxxxxxxxxxxxxxx>
	<xxxxxxxxxxxxxxxxxx>xxxx</xxxxxxxxxxxxxxxxxx>
	<xxxxxxxxx>127.0.0.1</xxxxxxxxx>
	<xxxxxxxxx>xxxxxxx xxxxxxx-xxxxxxxxxx/3.1</xxxxxxxxx>
	<xxxxxxxxxxxxx>xxxx/xxxx,xxxxxxxxxxx/xxxxx+xxx,xxxxxxxxxxx/xxx;x=0.9</xxxxxxxxxxxxx>
	<xxxxxxxxxxxxx>xxx</xxxxxxxxxxxxx>
	//<xxxxxxxxxx>01</xxxxxxxxxx>
	<xxxxxxxxxxxxxxxxxxxxxxxx>03</xxxxxxxxxxxxxxxxxxxxxxxx>
	<xxxxxxxxxxxxxxxxxxx>01,02</xxxxxxxxxxxxxxxxxxx>
	<xxxxxxxx>xxx64xxx-x19x-4728-8849-x3x50xxxxx39</xxxxxxxx>
	<xxxxxxxxxxxxx>${xxxxxxxxxxx}</xxxxxxxxxxxxx>
	<xxxxxxxxxxx>12341234</xxxxxxxxxxx>
	<xxxxxxxxxxxxx>xxxxxxxx</xxxxxxxxxxxxx>
</xxxxxxxxxxx>

    So based on the # of characters I'm passing in vs what I'm getting logged doesn't add up - I have data that should be in "chunk 2" that is missing and that last bit should be "chunk 3"