For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

NetworkTeam_178's avatar
NetworkTeam_178
Icon for Nimbostratus rankNimbostratus
Nov 04, 2016

Logging for iRule isn't working?

Hello,   I want to output rejections for this iRule to a syslog server. My syntax is   when HTTP_REQUEST { if { !(([HTTP::host] starts_with "website.co.uk") or ([HTTP::host] starts_with ";) o...
application delivery
iRules
LTM
security
VernonWells's avatar
VernonWells
Icon for Employee rankEmployee
Nov 04, 2016

Do you really mean 

starts_with
in these cases? Since .uk is a top-level domain, I assume you are not expecting Host header entries for something like "website.co.uk.foo.bar.baz.com". I ask because dropping the glob matching (and the asterisks at the end of the hostnames) makes the rule a bit faster, and I presume, more correct.

Also, 

log
delivers to the local syslog facility on the BIG-IP, which (unless you changed the syslog.conf) means it is going to a local file on the BIG-IP. If you want remote syslog, the best avenue is to use High Speed Logging from within your iRule:

  • cjunior's avatar
    cjunior
    Icon for Nacreous rankNacreous
    Nov 04, 2016

    For sure that for non-standard port, the "starts_with" is relevant to him.