Forum Discussion
asiosio_165682
Nimbostratus
NimbostratusiRule to log HTTP Request
Hello,
I have two F5 Big-IP:
- 1 * BIG-IP 11.4.1 Build 647.0 Hotfix HF4
- 1 * BIG-IP 10.2.4 Build 817.0 Hotfix HF7
I want to setup logging for HTTP traffic.
On the first F5 (11.4), no problem. I have created a request logging profile with this template:
$DATE_NCSA client=$CLIENT_IP:$CLIENT_PORT request=$HTTP_REQUEST virtual-server=$VIRTUAL_NAME($VIRTUAL_IP:$VIRTUAL_PORT) member=$SERVER_IP:$SERVER_PORTOn the second F5 (10.2), it is more complicated since the "Request logging profile" does not exist.. And i can't upgrade the device. I decided to create an iRule which produce a log with the same format (HTTP request).. But i don't know how to do.. Especially to generate "$DATE_NCSA" through the irule.
Any help would be very appreciated ! 🙂
Thanks
PS: please excuse my english 🐵
- The_Bhattman
Hi Asiosio,
I think the following posting might provide assistance. Please read
https://devcentral.f5.com/questions/writing-an-irule-to-log-all-traffic
Let us know if that helps resolve your issue?
asiosio_165682Hi "The Bhattman", and thanks for your answer :)
The problem is that i can't find the correspondance between my Request logging profile template variables ($DATE_NCSA, $HTTP_REQUEST, $VIRTUAL_NAME...) and iRule ones. For example, i do not know how to produce "$DATE_NCSA" with an iRule...
nitassEmployee
The problem is that i can't find the correspondance between my Request logging profile template variables ($DATE_NCSA, $HTTP_REQUEST, $VIRTUAL_NAME...) and iRule ones.
what about these?
% clock format [clock seconds] -format {%d/%m/%y:%H:%M:%S %Z} 11/08/14:00:49:41 PDTHTTP (HTTP::method, HTTP::uri, HTTP::version)
https://devcentral.f5.com/wiki/iRules.HTTP.ashxvirtual name
https://devcentral.f5.com/wiki/irules.virtual.ashx- asiosio_165682
Thanks for your answers.
I have almost made it... except for the date format.
Indeed the request logging profile is tampered with $DATE_NCSA variable which produce something like:
[11/Aug/2014:16:17:19 +0200]With the iRule I use the following:
set req_start_time [clock format [clock seconds] -format "%d/%m/%y:%H:%M:%S %Z"]which produces something like:
11/08/14:15:35:50 CESTI do not know how to make them "match" (for the syntax)..
Thanks
- nitass
% clock format [clock seconds] -format {%d/%b/%Y:%H:%M:%S %z} 11/Aug/2014:13:35:34 -0700clock format
