For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

basemsousan1985's avatar
basemsousan1985
Icon for Nimbostratus rankNimbostratus
Dec 12, 2016

logging DNS queries locally

Hi Guys,

 

please, I need help in this, I have configured GTM as transparent cache server, I need to enable query/response locally on the BIG-IP.

 

application delivery
BIG-IP
BIG-IP DNS

3 Replies

  • basemsousan1985's avatar
    basemsousan1985
    Icon for Nimbostratus rankNimbostratus
    Dec 12, 2016

    In fact, I wrote a simple iRule that worked smoothly, I need to send the result of this iRule to a syslog server, I noticed I have to use HSL API in my iRule, any help doing this

     

    when DNS_REQUEST { log local0. "QUERY from ([IP::client_addr]) for ([DNS::question class] [DNS::question type] [DNS::question name])"}

     

    when DNS_RESPONSE { log local0. "[IP::remote_addr] - LOCATION: [whereis [IP::remote_addr]] - QUESTION: [DNS::question name], [DNS::question type] - ANSWER: [DNS::answer]"}

     

  • basemsousan1985's avatar
    basemsousan1985
    Icon for Nimbostratus rankNimbostratus
    Dec 12, 2016

    Guys, please, check this issue, when I use hsl in my irule, I couldn't notice any logs recived by the syslog server, how can I troublshoot hsl irule

     

    when CLIENT_ACCEPTED { set hsl [HSL::open -proto UDP -pool Log_Pool] } when DNS_REQUEST {

     

    HSL::send $hsl "<190> LDNS: [IP::client_addr]) for ([DNS::question class] [DNS::question type] [DNS::question name]" }