iRules executed on both device when connection mirroring enabled

Hi Yanick,

Can you show your complete Irule. Mirroring holds the connection and persistence info to the standby unit with every packet flow. So whenever a connection is established to your setup, the same will be captured in your standby too. So this is expected. Can you share your complete Irule. I suspect there is some event in which some other log is getting captured too.

Hi, jaikumar,

Thank you for taking the time to answer my question, I appreciate it.

Here is my really simple iRule for logging purpose.

priority 2
when CLIENT_ACCEPTED {
  set cip_LCT [getfield [IP::client_addr] % 1 ]
  set cport_LCT [TCP::client_port]
  set vip_LCT [getfield [IP::local_addr] % 1 ]
  set vport_LCT [TCP::local_port]
}

when SERVER_CONNECTED {
  set sip [IP::server_addr]
  set sport [TCP::server_port]
  set snat_ip [IP::local_addr]
  set snat_port [TCP::local_port]
  set timestamp [clock format [clock seconds] -format {%Y-%m-%d_%H:%M:%S}]
  set partition [lindex [split [virtual name] /] 1]
  set script_name "logging_clients_tcp"  

  set hsl [HSL::open -proto UDP -pool /[lindex [split [virtual name] /] 1]/syslogi_pool ]

  HSL::send $hsl "<$partition>:<$script_name> Client IP: $cip:$cport -> Dest VIP: $vip:$vport to SNAT To: $snat_ip:$snat_port -> $sip:$sport"
  HSL::send $hsl "<[lindex [split [virtual name] /] 1]>: Client IP: [getfield $cip_LCT % 1]:$cport_LCT -> [getfield $vip_LCT % 1]:$vport_LCT to SNAT To: [getfield [IP::local_addr] % 1]:[TCP::local_port] -> [getfield [IP::server_addr] % 1]:[TCP::server_port] "
}

This is a really simple rule. I don't understand the behavior of not having the exact same line being sent to my syslog server.

You confirm me that it is normal to have iRules being executed on every device in my device group (I have 2 devices in fact, one active, one standby) that aren't active?

If that is the case, is there a variable that I can use onto an iRules to know if the device is active or standby? Having that, I will add a condition to only send logs to my syslog server for the "Active" device. Thank you again and best regards, Yanick

So when mirroring is enabled for the VS, the Irule does executes on the Standby too. To get the device status, you can use the HA::status option,

when CLIENT_ACCEPTED {
    log local0. "active: [HA::status active]"
    log local0. "standby: [HA::status standby]"
}
 /var/log/ltm log output:
 : active: 1
 : standby: 0