Forum Discussion
Ryan_M_362715
Altocumulus
AltocumulusLogging APM Username and XFF Address
I'm trying to create a single log entry that is triggered by an ACCESS_POLICY_AGENT_EVENT containing a user's username (after successful logon) and their X-Forwarded-For address. This log needs to b...
Stanislas_Piro2
Cumulonimbus
CumulonimbusUse this code
when ACCESS_SESSION_STARTED {
ACCESS::session data set session.custom [HTTP::header X-Forwarded-For]
}
when ACCESS_POLICY_COMPLETED {
log local0. "SESSION_STARTED, User=[ACCESS::session data get session.logon.last.username], IP=[ACCESS::session data get session.custom.xff]"
}