iRule that generates an email

Chad,

 

 

At this time there isn't the capability built in to fire an email from within an iRule.

 

 

You can, however, set syslog-ng to send an email based on a trap that comes through when a certain event is logged. You can then build an iRule to log that event (via the log command) in the needed format so that syslog-ng picks up on it, and sends the email.

 

 

Here's some info on syslog-ng from the BIG-IP 9 manual. Click here

 

 

Hopefully this will get you started.

 

 

-Colin

Thanks Colin! I'm going to give this a shot and reply back with how it works.

We have syslog-ng setup to email us whenever the term "script_kiddies" shows up in the ltm logs. I've used unRuley's post (http://devcentral.f5.com/Default.aspx?tabid=28&view=topic&forumid=5&postid=2169) as a starting point for our rule to notify us when one connection hits a particular site more than three times per second. The rule I've written is not looping correctly, any suggestions? Here's the rule I have so far:

 
when HTTP_REQUEST {
   log "$reqs_sec [HTTP::uri]"
   set cur_time [clock seconds]
   if { [HTTP::request_num] > 1 } {
      if { $cur_time == $start_time } {
        if { [HTTP::uri] contains "SomethingInTheURI" } { 
         incr reqs_sec 
         log "$reqs_sec"         
         if { $reqs_sec > "3" } {
           log "to [HTTP::uri]"
           log "script_kiddies from [IP::client_addr] hit [HTTP::uri] three or more times per second at $cur_time"
           return
         }
       }
   }   
}
  set reqs_sec "0" 
  set start_time $cur_time
}

Here's is unRuleY's original rule:

when HTTP_REQUEST { 
    set cur_time [clock seconds] 
    if { [HTTP::request_num] > 1 } { 
       if { $cur_time == $start_time } { 
          if { $reqs_sec > 3 } { 
             HTTP::respond 503 Retry-After 2 
          } 
          incr reqs_sec 
          return 
       } 
    } 
    set start_time $cur_time 
    set reqs_sec 0 
 }

When you say it's not looping properly...what do you mean? Could you provide some more clarification as to how the iRule is behaving in comparison to how you'd like it to behave?

 

 

Thanks,

 

-Colin

I think you may want to place the

if { [HTTP::uri] contains "SomethingInTheURI" } {

at a higher level (perhaps combined with the HTTP::requests > 1 line.

Basically, I think you have a logic problem. You should map out a logic table and see if it is what you expect. (A logic table is where you take all the variables/inputs and then assign them the range of logical values and map out the results).