log response ASM cookies

Hello Aaron,

 

 

Thanks, I updated the i-Rule as you suggested but its logging every IP,

 

(not only the IP in the condition).

 

so I added another IF to the Response. (and now its logging only the requested IP)

 

do you have any idea why it didn't work?

 

 

when HTTP_REQUEST {

 

if {[IP::addr [IP::client_addr] equals 192.118.92.3]}{

 

set uri [HTTP::uri]

 

}

 

}

 

 

when HTTP_RESPONSE {

 

if {[IP::addr [IP::client_addr] equals 192.118.92.3]}{

 

only look for TS cookies if it's a response to the specific client

 

if {[info exists uri]}{

 

loop through cookie names

 

foreach aCookie [HTTP::cookie names] {

 

log cookie names and values that start with TS

 

if { $aCookie starts_with "TS"}{

 

log local0. "client: [IP::client_addr] received cookie $aCookie=[HTTP::cookie value $aCookie] in response to request for $uri"

 

}

 

}

 

}

 

}

 

}