Forum Discussion

Arkashik_6155's avatar
Arkashik_6155
Icon for Nimbostratus rankNimbostratus
Jan 04, 2013

iRule to log POP3/IMAP user

Hello everyone,   Since i'm new with iRules, could you please advice me how to log username/user's email address from POP3 and IMAP sessions.   The goal is to move users to go through POP3/IMAP...
application delivery
dev
devops
iRules
nitass's avatar
nitass
Icon for Employee rankEmployee
Jan 05, 2013
imap 

root@(B3900-R72-S16)(cfg-sync Standalone)(Active)(/Common)(tmos) list ltm virtual bar143
ltm virtual bar143 {
    destination any:143
    ip-protocol tcp
    mask any
    pool gw
    profiles {
        tcp { }
    }
    rules {
        myrule143
    }
    source 0.0.0.0/0
    source-address-translation {
        type automap
    }
    translate-address disabled
    translate-port disabled
    vlans-disabled
}
root@(B3900-R72-S16)(cfg-sync Standalone)(Active)(/Common)(tmos) list ltm rule myrule143
ltm rule myrule143 {
    when CLIENT_ACCEPTED {
  TCP::collect 0 0
}
when CLIENT_DATA {
  if { [TCP::payload] contains "LOGIN" } {
    scan [TCP::payload] {%*s LOGIN %s} username
    log local0. "username $username"
    TCP::release
    return
  }
  TCP::release
  TCP::collect
}
}

[root@B3900-R72-S16:Active:Standalone] config  tail -f /var/log/ltm
Jan  5 03:16:22 B3900-R72-S16 info tmm3[11078]: Rule /Common/myrule143 : username "garfield@something.com"
Jan  5 03:16:22 B3900-R72-S16 info tmm2[11078]: Rule /Common/myrule143 : username "garfield@something.com"
Jan  5 03:16:22 B3900-R72-S16 info tmm1[11078]: Rule /Common/myrule143 : username "odie@something.com"
Jan  5 03:16:22 B3900-R72-S16 info tmm[11078]: Rule /Common/myrule143 : username "odie@something.com"