Forum Discussion

skkg_111590's avatar
skkg_111590
Icon for Nimbostratus rankNimbostratus
Feb 09, 2011

irule to capture server ---> to client traffice and vice versa

Hi ,

 

 

I need help to create an irule that will be applied to vip –(http).

 

 

When ever client gets 503 errors from the servers it records the error in the logs.

 

Also 2nd rule

 

To log all the traffic from servers to the client and vice versa.

 

 

i.e

 

 

log local0 /var/log tail –f ltm ---is it the correct way to view the logs of local0 -- but if I want to keep them should I change to local1

 

,

 

 

 

Thanks a lot

 

 

Regards

 

Markalo

 

application delivery
dev
devops
iRules
  • Chris_Miller's avatar
    Chris_Miller
    Icon for Altostratus rankAltostratus
    Feb 09, 2011
    When you say "log all traffic from servers to the client and vice versa," what are you looking for? This essentially sounds like a packet capture and isn't an efficient use of LTM. If you're trying to log all HTTP Requests and Responses, that could be possible but will still be a lot of data.
  • Chris_Miller's avatar
    Chris_Miller
    Icon for Altostratus rankAltostratus
    Feb 10, 2011
    Posted By skkg on 02/09/2011 04:47 PM

     

    looking for 503 errors ---- from server to cleint.

     

    thx

     

     

    I was asking about the "second rule."
  • skkg_111590's avatar
    skkg_111590
    Icon for Nimbostratus rankNimbostratus
    Feb 10, 2011
    sorry --

     

    sencond rule is to capture

     

    HTTP Requests and Responses. thx
  • Chris_Miller's avatar
    Chris_Miller
    Icon for Altostratus rankAltostratus
    Feb 10, 2011
    
when HTTP_REQUEST {
set methodvar [HTTP::method]
set hostvar [HTTP::host]
set urivar [HTTP::uri]
set clientvar [IP::remote_addr]
   log local0. "Client: [IP::remote_addr]:[TCP::remote_port] requested [HTTP::method] / [HTTP::host][HTTP::uri]"
}
when HTTP_RESPONSE {
   if { [HTTP::status] eq "503" } {
     log local0. "$clientvar received 503 error for $methodvar / $hostvar$urivar" }
}

    That should be a start.