Logging client connections to syslog

Hi Brian,

In 10.1.0 or higher, you could use HSL to log directly to an external pool of syslog servers. You could do one log send in CLIENT_CLOSED with the client IP:port, SNAT IP:port, server IP:port:

 From: http://devcentral.f5.com/wiki/default.aspx/iRules/HSL__send.html
when CLIENT_ACCEPTED {
   set hsl [HSL::open -proto UDP -pool syslog_pool]
}
when SERVER_CONNECTED {
set log_line "[IP::client_addr]:[TCP::client_port] <-> [clientside {IP::local_addr}]:[clientside {TCP::local_port}] [IP::local_addr]:[TCP::local_port] <-> [IP::server_addr]:[TCP::server_port]"
}
when CLIENT_CLOSED {
    Log connection details as local7.info; see RFC 3164 Section 4.1.1 - "PRI Part" for more info
   HSL::send $hsl "<190> $log_line"
}

In 9.4.0 - 10.0.x you could use 'log -remote' for this:

http://devcentral.f5.com/wiki/default.aspx/iRules/log

9.4.0 Added and parameters

Aaron

The above script didn't work for me (LTM 10.2.1) until I tweaked it a bit.

 From: http://devcentral.f5.com/wiki/default.aspx/iRules/HSL__send.html
when CLIENT_ACCEPTED {
  set hsl [HSL::open -proto UDP -pool syslog-pool]
}
when SERVER_CONNECTED {
  set FrontEnd "[IP::client_addr]:[TCP::client_port] <-> [clientside {IP::local_addr}]:[clientside {TCP::local_port}]"
  set BackEnd  "[IP::local_addr]:[TCP::local_port] <-> [serverside {IP::remote_addr}]:[TCP::server_port]"
   Log connection details as local7.info; see RFC 3164 Section 4.1.1 - "PRI Part" for more info
  HSL::send $hsl "<190> HSL: $FrontEnd | $BackEnd"
}

1. With the HSL::send in the CLIENT_CLOSED event I got "TCL error: connection_logging-rule - can't read "log_line": no such variable while executing "HSL::send $hsl "<190> $log_line". It was fine once I moved it to SERVER_CONNECTED.

2. "[IP::server_addr]" was giving me the VS address instead of the back-end server IP so I changed it to "[serverside {IP::remote_addr}]".

I also broke the log line into two parts just for clarity.

Now it generates a local7.info life that looks like

HSL: 10.3.225.11:3961 <-> 10.13.171.14:80 | 10.3.225.11:3961 <-> 10.13.17.44:80

Does anyone know of any issues that might be caused by moving the logging to SERVER_CONNECTED?

 

 

Any idea why I was getting the "can't read 'log_line'" message?

 

[root@edelweiss:Active] config b version|grep -iA 1 version

 

BIG-IP Version 10.2.1 511.0

 

Hotfix HF3 Edition

 

 

[root@edelweiss:Active] config b virtual bar list

 

virtual bar {

 

snat automap

 

pool foo

 

destination 172.28.17.77:http

 

ip protocol tcp

 

rules myrule

 

}

 

 

[root@edelweiss:Active] config b rule myrule list

 

rule myrule {

 

when CLIENT_ACCEPTED {

 

set hsl [HSL::open -proto UDP -pool syslogpool]

 

}

 

when SERVER_CONNECTED {

 

set log_line "[IP::client_addr]:[TCP::client_port] <-> [clientside {IP::local_addr}]:[clientside {TCP::local_port}] [IP::local_addr]:[TCP::local_port] <-> [IP::server_addr]:[TCP::server_port]"

 

}

 

when CLIENT_CLOSED {

 

Log connection details as local7.info; see RFC 3164 Section 4.1.1 - "PRI Part" for more info

 

HSL::send $hsl "<190> $log_line"

 

}

 

}

 

 

[root@edelweiss:Active] config tail -f /var/log/ltm

 

[root@edelweiss:Active] config

 

 

C:\>nc -l -u -p 514

 

<190> 192.168.206.96:51759 <-> 172.28.17.77:80 10.10.72.70:51759 <-> 10.10.70.110:80

 

 

is it possible that your client connection closed before server_connect was triggered?

 

 

iRules HTTP Event Order Update

 

http://devcentral.f5.com/weblogs/jason/archive/2011/02/01/irules-http-event-order-update.aspx