Log Bytes Send/Received (WEB TRAFFIC) in F5 via iRules or BIG-IP

 

Hi,

 

I tried using "[HTTP::payload length]" in both HTTP_REQUEST and HTTP_RESPONSE . But the results obtained did not match with the IIS logs.

 

Please let me know if you have information on this

 

 

example

 

 

F5 logs :

 

 

May 25 12:10:24 tmm tmm[26111]: Rule getip : Client IP: 10.210.36.134 -> ClientPort: 2416 -> Domain: www.test22.de -> Method: GET -> Uri: /text.gif -> Host: www.test22.de -> Query: -> Connection: Keep-Alive -> Version: 1.1 -> Username: -> User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; .NET CLR 1.1.4322; .NET CLR 2.0.50727) Status: 200 -> Referer: https://www.test22.de/ -> AcceptLanguage: en-us -> AcceptEncoding: gzip, deflate -> LastModified: Mon, 05 Apr 2004 09:15:00 GMT -> Date: Fri, 25 May 2007 06:20:09 GMT -> RequestCookie: -> RequestCookieCount: 0 -> ResponseCookie: -> ResponseCookieCount: 0 -> TimeEstimate: 0 -> RequestPayLoadLength: 0 -> ResponsePayLoadLength: 1210

 

 

IIS logs:

 

 

Fields: date time s-ip cs-method cs-uri-stem cs-uri-query s-port cs-username c-ip cs(User-Agent) sc-status sc-substatus sc-win32-status sc-bytes cs-bytes time-taken

 

2007-05-25 06:20:09 10.210.36.136 GET /text.gif - 80 - 10.210.36.159 Mozilla/4.0+(compatible;+MSIE+6.0;+Windows+NT+5.2;+SV1;+.NET+CLR+1.1.4322;+.NET+CLR+2.0.50727) 200 0 0 1698 294 109

 

 

The sc-bytes (Bytes sent)= 1698 and cs-bytes (Bytes Received)= 294 in the IIS logs is different from RequestPayLoadLength: 0 -> ResponsePayLoadLength: 1210 logged in FS logs