iRules for monitoring source and destination address

Hi Hartono,

The first part can be done by applying the following sample iRule

  
  when CLIENT_ACCEPTED {  
     log local0. "The Client Address is [IP::client_addr]  
    }  
  

This will apply to the LTM log file every-time the VIP is accessed.

I am not exactly sure how to approach the second part of your request regarding duration. I am not even sure if it's possible to report against duration against all connections.

Bhattman

Hi Bhattman,

 

 

Thanks for replying. Your iRules worked very well. There are some questions I want to ask

 

1. Could that iRules work without binded to a specific Virtual Server?

 

2. What I mean for the time connection is. Could an iRule track the time usage (for example internet user has connected to Virtual_Server_A for 1 hour) ?

 

3. What is the parameter in order iRules can appear the Virtual Server IP address?

 

 

 

 

Thanks

 

Hartono

Hi Hartono,

 

To answer your question

 

 

1. iRules are only processed at the VIP level. So yes it must be binded to the VIP

 

2. iRules can facilitate a method of tracking time. However, what it can't do is track the duration of MANY users has been connected to a virtual.

 

3. Can you re-explain this question, I am not sure what you exactly mean by Irules appears the virtual address?

 

 

I hope this helps

 

 

Bhattman

Hi Bhattman,

 

 

2. Would you mind if u give me the iRules for tracking time between tcp open and tcp close ?

 

3. What I mean is, how can I show the virtual server ip address in the syslog log ?

 

 

 

Thanks

 

Hartono

 

 

 

 

 

 

Posted By Bhattman on 03/08/2010 9:59 AM

 

 

Hi Hartono,

 

To answer your question

 

 

1. iRules are only processed at the VIP level. So yes it must be binded to the VIP

 

2. iRules can facilitate a method of tracking time. However, what it can't do is track the duration of MANY users has been connected to a virtual.

 

3. Can you re-explain this question, I am not sure what you exactly mean by Irules appears the virtual address?

 

 

I hope this helps

 

 

Bhattman

 

 

 

Hi Hartono,

I can only answer item 3. Which is

 
 when CLIENT_ACCEPTED { 
    log local0. "Virtual IP address being accessed is: [IP::local_addr]" 
 } 
 

Bhattman

You can track the start time of a TCP connection in CLIENT_ACCEPTED using 'set start [clock clicks -milliseconds]' and then calculate the delta in CLIENT_CLOSED using '[expr {[clock clicks -milliseconds] - $start}]'. Here is an example:

 

 

http://devcentral.f5.com/wiki/default.aspx/iRules/LogTcpAndHttpRequestResponseInfo.html

 

 

Aaron

I think a good question to ask here is what are you trying to accomplish?? What kind of traffic is this? Do you have persistence enabled?

 

 

If you're looking to track time spent on your web site/web app, some analytic tools on the webserver side might serve you better...

 

 

It sounds like this is something ongoing you want to monitor from the mention of logging.. but if it isn't you could measure absolute time by running some TCP dumps and keying on the source address...