Forum Discussion
Mattmans1
Nimbostratus
NimbostratusLogging all VIP connections to syslog - Irule only?
Hi Guys, I have around 35 VIP's setup on my LTM - i have a requirement to log the original Source IP of the requesting client to a syslog server so we can audit who has been accessing the servers...
Its possible via iRule to capture client IP address but default F5 syslogs "/var/log/ltm" file will quickly fill. Assign below iRule to all VIPs.
when HTTP_REQUEST { log local0. "clientIP:[IP::client_addr] accessed [HTTP::host][HTTP::uri]" }Please review my old post: https://devcentral.f5.com/s/question/0D51T00006i7k94/capturing-source-ip-addresses-for-vip
Samir
MVP
MVPIts possible via iRule to capture client IP address but default F5 syslogs "/var/log/ltm" file will quickly fill. Assign below iRule to all VIPs.
when HTTP_REQUEST {
log local0. "clientIP:[IP::client_addr] accessed [HTTP::host][HTTP::uri]"
}Please review my old post: https://devcentral.f5.com/s/question/0D51T00006i7k94/capturing-source-ip-addresses-for-vip
Mattmans1Nimbostratus
NimbostratusHello Samir,
Thankyou so much, just what i was looking for. Do you know if this is the same as configuring a HTTP profile? Would it do the same thing?
Am i also right in thinking that if you had a custom VIP for a random SSH jump server that you would have to use an irule to log that since you cant use a HTTP profile?