hey thanks for taking the time to reproduce though my behaviour is different. I've added when ACCESS_SESSION_STARTED and I do see the session. Even when simply trying the [HTTP::host][HTTP::uri] directly from a web browser.
*Apr 8 16:08:17 lhr4-exlb-01 notice tmm2[18680]: Rule /Common/OS-X_Kill_Preauth : hey I found a Mac so Disabling Acces policy...CLIENT IP 10.164.4.23 user agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:35.0) Gecko/20100101 Firefox/35.0 and uri: /ews/exchange.asmx
Apr 8 16:08:17 lhr4-exlb-01 notice tmm2[18680]: Rule /Common/OS-X_Kill_Preauth : Access session started for 10.164.4.23 and user agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:35.0) Gecko/20100101 Firefox/35.0*
irule:
when HTTP_REQUEST { set u [HTTP::header "User-Agent"]
set uru [HTTP::uri]
log local0.notice "user agent: $u and uri: $uru"
if {[string tolower [HTTP::header "User-Agent"]] contains "mac os x" } {
ACCESS::disable
log local0.notice "hey I found a Mac so Disabling Acces policy...CLIENT IP [IP::client_addr] user agent: $u and uri: $uru"
}
}
when CLIENT_ACCEPTED {
ACCESS::restrict_irule_events disable
}
when ACCESS_SESSION_STARTED {
log local0.notice "Access session started for [IP::client_addr] and user agent: [HTTP::header "User-Agent"]"
}