Forum Discussion

Eduardo_Saito_1's avatar
Eduardo_Saito_1
Icon for Nimbostratus rankNimbostratus
Oct 15, 2007

Log - Few details left....

Hello Everybody.

 

 

 

I'm coding a W3C log format for HTTP traffic. The irule is working fine:

 

 

 

The Code:

 


log local0.info "$client_ip $remote_logname $remote_user \[$date_and_time -0300\] \"$client_method $uri HTTP/$http_version\" $status $bytes_sent \"$referer\" \"$user_agent\""

 

 

 

Here is the output:

 

 


Oct 15 09:41:20 tmm tmm[1057]: Rule irule_logw3c : 10.0.0.52 - - [15/Oct/2007:09:41:20 -0300] "GET /pagerror.gif HTTP/1.1" 200 2806 "-" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0; SLCC1; .NET CLR 2.0.50727; Media Center PC 5.0; .NET CLR 3.0.04506; .NET CLR 1.1.4322)"

 

 

 

Question:

 

 

Is it possible to remove the "Oct 15 09:37:57 tmm tmm[1057]: Rule irule_logw3c : " from it?

 

 

 

Thanks!!!
application delivery
dev
devops
iRules
  • JRahm's avatar
    JRahm
    Icon for Admin rankAdmin
    Oct 15, 2007
    Not in an iRule. You can edit the source of syslog-ng to log this way, or you can redirect the output to a flat textfile or a database with the fields you choose. Here is a sample file that gives you your options.

     

     

    http://www.campin.net/syslog-ng/expanded-syslog-ng.conf