Log to syslogserver in reporting-ready format

A few more information about the logging

 

 

since v9.4.4 you can send straight from an iRule to a remote syslog server:

 

 

Note: it assumes 10.1.1.1 is a remote syslog server that is routable using a TMM VLAN:

 

 

when HTTP_REQUEST {

 

HTTP::collect 4096

 

}

 

 

when HTTP_REQUEST_DATA {

 

 

log 10.1.1.1 local0.info puts "HTTP POST data is [HTTP::payload]“}

 

}

 

 

The thing is by default you may end with messager larger than 1KB. They added a new db variable that allow larger messages: tmm.maxremoteloglength

 

 

Now doing everything from iRules may not always be the best for performance. I'm not sure about if it takes more processes or less to do it straight from an iRule

 

 

One more thing if you decide to go through syslog-ng since you said you have a high traffic application:

 

 

There is a significant behavioral difference when the optional . is specified. When iRule logs messages without the facility and/or level, they are rate-limited as a class and subsequently logged messages within the rate-limit period may be suppressed even though they are textually different. However, when the and/or are specified, the log messages are not rate-limited (though syslog-ng will still perform suppression of repeated duplicates).”

 

 

So use the log . when doing your job