For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

sjredo_256558's avatar
sjredo_256558
Icon for Nimbostratus rankNimbostratus
Jul 14, 2016

iRule to log RST timeouts?

Hi there, we're trying to log RST for a single vs/pool ideally through an irule, but I've only found a way to do it through tmsh which enables it for the whole device, therefore filling it up with logs pretty quickly.

 

Is there a way to enable "modify /sys db tm.rstcause.log value enable" for just a vip/pool or some way to do it through an irule?

 

I've read somewhere else that irules can't read raw tcp which is why it couldn't be done.

 

Thanks!!

 

devops
iRules
TMSH

1 Reply

  • Vijay_E's avatar
    Vijay_E
    Icon for Cirrus rankCirrus
    Jul 15, 2016

    Can't you grep the logs for the specific VS/Pool ? Which particular event are you trying to capture by logging RST ? I mean, among the many reasons for which the F5 will send a RST, are you specifically interested in any or all ?

     

    Have you seen this article on TCP options: https://devcentral.f5.com/articles/accessing-tcp-options-from-irules