Forum Discussion

MR_RJ's avatar
Icon for Cirrus rankCirrus
Dec 01, 2011

iRule to log type of http content from which source IPs




I got a request that im trying to find a good solution for.


The thing we need to be solved is... we got a webservice that we are about to make some changes to. We need to identify which source IPs that is using soap 1.2/1.1 and so on.



The way I first thought of was solving it with the iRule below.





if { [HTTP::header value Content-Type] contains "application/soap+xml" } {


log local0. "SourceIP [IP::remote_addr] - Content contain [HTTP::header value Content-Type]"







...the annoying part is that the local syslog will be filled with information, and still I cant get statistics on how many calls from each IP and what type of content.



Would be nice with some kind of dynamic list that can be stored in .txt or even better in a table.


The statistics profile is, as far as I know a static list, the fields must be created first and the data is only a counter.



My wishes is to create a list like:


SOURCEIP CONTENT COUNT "application/soap+xml" 50000



Any suggestions on how to solve this in a good looking way? =)






1 Reply

  • Hi Mr_RJ,



    I think that you are on the right track. Parsing multiple LTM Logs for statistical information would be a nightmare.



    I would suggest using the new Table command if you are on v10.x.x or higher.



    If it's ability peeks your interest I would suggest reviewing Colin's Tech Tip over Heatmaps. In that series he uses the Table Command to gather and reset statistics, and builds a presentation page using Google Charts API to present the data. It's an excellent series.



    Heatmaps - Part 1


    Heatmaps - Part 2


    Heatmaps - Part 3


    Heatmaps - Part 4



    Hope this helps.