Forum Discussion
bdavis
Nimbostratus
NimbostratusIssue with Basic irule.
Hello all,
I was hoping someone can possibly shed some light on this issue I am having. I am a network engineer trying to be a proggrammer so bare with me. I was trying write this irule below to beable to pull a few indentifing credentials out of the http header and log them with the uri they are requesting. The problem I am seeing is the irule will log the x-forwarded-for as well as the host and uri. But it cannot seem to find the SM_USER or the SM_SESSIONSERVERID. When I perform a Tcpdump to Wireshark I can clearly see that there present. Am I just overlooking something very simple? Thank You
when HTTP_REQUEST {
set LogString "Client [HTTP::header SM_USER]:[HTTP::header SM_SERVERSESSIONID]:[HTTP::header X-Forwarded-For] -> [HTTP::host][HTTP::uri]"
log local3. "$LogString (request)"
}
5 Replies
- The_BhattmanDid you try putting the headers in single '
when HTTP_REQUEST { set LogString "Client [HTTP::header 'SM_USER']:[HTTP::header 'SM_SERVERSESSIONID']:[HTTP::header 'X-Forwarded-For'] -> [HTTP::host][HTTP::uri]" log local3. "$LogString (request)" }
I hope this works
Bhattman 
hoolioCirrostratus
The rule you have should work fine to log the values of the headers. Are you sure SM_USER and SM_SESSIONSERVERID are HTTP header names in the request coming into the VIP? Can you post an anonmyized snippet from the tcpdump?
Aaron
bdavisI have not tried single ' I have tried double ". I will try that out and see what it does. As well as the anonmyized snippet. I am working on getting a snippet I am at home today, as well this is a secure location so I will also have to scrubb it of the values and only leave the headers names. Thanks all.- bdavisThis rule is working now. I did not have to change anything. when I was copying it out of wordpad, it was doing something to the format. I rewrote it directly in a new irule and it works fine. Thanks.
- Now, if only the powers that be would have allowed me to use my original name "iRuler", I'd be a happy camper! I was able to keep the executable name of iRuler.exe though. Thanks for bringing back the memories hoolio!!!
-Joe
