Forum Discussion

Mike_73765's avatar
Mike_73765
Icon for Nimbostratus rankNimbostratus
Jan 05, 2011

Logging Certain number of characters with HTTP::request

Hello,

 

 

I am logging the following info:

 

 

log local0. "Client Address: [IP::client_addr], HTTP Header: [HTTP::request]"

 

 

A sample output from the HTTP::request command is:

 

 

Client Address: 192.168.1.15, HTTP Header: GET /site/shadowbox/play.png HTTP/1.1 Accept: */* Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.2; .NET CLR 1.1.4322) Host: site.com Connection: Keep-Alive Cookie: UserAgentId=-1067132148225647718996; JSESSIONID=; site.server=webserver2; site.web.server=webserver2; runId=-6772998382442248823763483

 

 

I want to log only up until the point of the GET request. So the desired output would look like this:

 

 

Client Address: 192.168.1.15, HTTP Header: GET /site/shadowbox/play.png

 

 

 

How can I grab just the GET out of this header?

 

 

 

Thanks,

 

Mike
application delivery
dev
devops
iRules

3 Replies

Sort By
  • Mike_73765's avatar
    Mike_73765
    Icon for Nimbostratus rankNimbostratus
    Jan 05, 2011
    sorry, titled the post wrong. cant use number of characters because that varies. i'd like to log up to HTTP/
  • Colin_Walker_12's avatar
    Colin_Walker_12
    Historic F5 Account
    Jan 05, 2011
    I think you can get what you're looking for by combining a few pre-built commands rather than doing some complicated scan or regular expression.

    Check out these commands:

    HTTP::method - http://devcentral.f5.com/wiki/default.aspx/iRules/HTTP__method.html

    HTTP::uri - http://devcentral.f5.com/wiki/default.aspx/iRules/HTTP__uri.html

    and

    IP::client_addr - http://devcentral.f5.com/wiki/default.aspx/iRules/IP__client_addr.html,

    If you put these three together I think you can achieve 100% of what you're looking for easily and for very few cycles.

    Something like this: 

    when HTTP_REQUEST {
  log local0. "Client Address:[IP::client_addr], Request Type:[HTTP::method], Request URI:[HTTP::uri]"
}

    Simple, but it should get you where you want to go, unless there's something specific in the header past those pieces of information that you want.

    Colin
  • Mike_73765's avatar
    Mike_73765
    Icon for Nimbostratus rankNimbostratus
    Jan 05, 2011
    Thanks Colin. HTTP::uri will work for me.

     

     

    One other question I have is that I want to put a timestamp on each log entry, but it is coming back with a day in March of 2016.

     

     

    When I go to the cli and get the date, clock, and hwclock dates/times, those are all the accurate date and time. Here is what i have for the timestamp.

     

     

    when HTTP_REQUEST {

     

    set timestamp [clock format [clock clicks -milliseconds]]

     

    log local0. "Client Address: [IP::client_addr], Timestamp: $timestamp, Request URI:[HTTP::uri]"

     

    }