For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

bdavis's avatar
bdavis
Icon for Nimbostratus rankNimbostratus
Feb 25, 2010

Issue with Basic irule.

Hello all,

 

 

I was hoping someone can possibly shed some light on this issue I am having. I am a network engineer trying to be a proggrammer so bare with me. I was trying write this irule below to beable to pull a few indentifing credentials out of the http header and log them with the uri they are requesting. The problem I am seeing is the irule will log the x-forwarded-for as well as the host and uri. But it cannot seem to find the SM_USER or the SM_SESSIONSERVERID. When I perform a Tcpdump to Wireshark I can clearly see that there present. Am I just overlooking something very simple? Thank You

 

 

 

when HTTP_REQUEST {

 

set LogString "Client [HTTP::header SM_USER]:[HTTP::header SM_SERVERSESSIONID]:[HTTP::header X-Forwarded-For] -> [HTTP::host][HTTP::uri]"

 

log local3. "$LogString (request)"

 

}
application delivery
dev
devops
iRules

5 Replies

  • The_Bhattman's avatar
    The_Bhattman
    Icon for Nimbostratus rankNimbostratus
    Feb 25, 2010
    Did you try putting the headers in single ' 

      
  when HTTP_REQUEST {   
  set LogString "Client [HTTP::header 'SM_USER']:[HTTP::header 'SM_SERVERSESSIONID']:[HTTP::header 'X-Forwarded-For'] -> [HTTP::host][HTTP::uri]"   
  log local3. "$LogString (request)"   
  }

    I hope this works

    Bhattman

  • hoolio's avatar
    hoolio
    Icon for Cirrostratus rankCirrostratus
    Feb 25, 2010
    The rule you have should work fine to log the values of the headers. Are you sure SM_USER and SM_SESSIONSERVERID are HTTP header names in the request coming into the VIP? Can you post an anonmyized snippet from the tcpdump?

     

     

    Aaron
  • bdavis's avatar
    bdavis
    Icon for Nimbostratus rankNimbostratus
    Feb 26, 2010
    I have not tried single ' I have tried double ". I will try that out and see what it does. As well as the anonmyized snippet. I am working on getting a snippet I am at home today, as well this is a secure location so I will also have to scrubb it of the values and only leave the headers names. Thanks all.
  • bdavis's avatar
    bdavis
    Icon for Nimbostratus rankNimbostratus
    Mar 02, 2010
    This rule is working now. I did not have to change anything. when I was copying it out of wordpad, it was doing something to the format. I rewrote it directly in a new irule and it works fine. Thanks.
  • Joe_Pruitt's avatar
    Joe_Pruitt
    Mar 02, 2010
    Now, if only the powers that be would have allowed me to use my original name "iRuler", I'd be a happy camper! I was able to keep the executable name of iRuler.exe though. Thanks for bringing back the memories hoolio!!!

     

     

    -Joe