For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

neeeewbie's avatar
Aug 13, 2025
Solved

Is it possible to properly log protobuf?

I'm currently receiving decoded traffic in span mode. However, content-type: application/proto is not logged properly. Is there a way to resolve this issue?
  • Jeffrey_Granier's avatar
    Aug 14, 2025
    when HTTP_REQUEST {
        # Check for Protobuf content-type
        if {[HTTP::header "Content-Type"] contains "application/proto"} {
            # Collect the payload (up to 1MB; adjust size if needed, but beware of performance impact)
            HTTP::collect [HTTP::header "Content-Length"]
        }
    }
    
    when HTTP_REQUEST_DATA {
        # Convert binary payload to hex for logging
        set payload [HTTP::payload]
        binary scan $payload H* hex_payload
        log local0. "Protobuf Payload (Hex): $hex_payload | Client IP: [IP::client_addr] | URI: [HTTP::uri]"
        
        # Optional: Release the payload to continue processing
        HTTP::release
    }

    Hello,

     

    You would need to have the traffic sent through a VIP to apply an irule that could potentially do some conversion etc.. I have not tested this so please do this in a non-prod environment!   I highly recommend checking out our F5 AI Assistant Introduces iRules Code Generation for BIG-IP | F5 !