Logging if certain HTTP Query Strings are Null

Question

I have a query string that looks like the following:

s_sample=test&t_sample=test&u_sample=test.

I'm trying to determine the most effective way to log when s_sample, t_sample, or u_sample don't have a value.

Thoughts?

hoolio · Answer

Hi Chris, 
&nbsp;  
&nbsp; Are the parameter names always going to be set in the same order?  Are you trying to log the query string only when all three are present and any of them don't have a value? 
&nbsp;  
&nbsp; I'm thinking you could use scan to do this. 
&nbsp;  
&nbsp; Aaron

hoolio · Answer

Not pretty,  but it seems to work assuming I have the scenario correct: 
&nbsp;  
&nbsp; scan [string range [HTTP::query] [string first "s_sample=" [HTTP::query]] end] {s_sample=%[^&amp;]&amp;t_sample=%[^&amp;]&amp;u_sample=%[^&amp;]} 
&nbsp;  
&nbsp; Here is a description of the steps: 
&nbsp;  
&nbsp;  Save a test query with some parameters and values including the three sample parameters in order 
&nbsp; set query {blah=val&amp;s_sample=s_sample_value&amp;t_sample=t_sample_value&amp;u_sample=u_sample_value&amp;blah=val2} 
&nbsp;  
&nbsp;  Get the index of the first sample parameter 
&nbsp; string first "s_sample=" $query 
&nbsp;  
&nbsp;  Trim off everything up to the first sample parameter name 
&nbsp; string range $query [string first "s_sample=" $query] end 
&nbsp;  
&nbsp;  Scan the trimmed string to get the values for the three sample parameters.  If it doesn't return 3, then one or more of the parameters wasn't matched and parsed 
&nbsp; scan [string range $query [string first "s_sample=" $query] end] {s_sample=%[^&amp;]&amp;t_sample=%[^&amp;]&amp;u_sample=%[^&amp;]} 
&nbsp;  
&nbsp; I'm guessing there might be a cleaner solution if you can give more detail on the scenario. 
&nbsp;  
&nbsp; Aaron

chris_miller · Answer

Thanks for the quick reply Aaron! 
&nbsp;  
&nbsp; The query strings will always be in the same order. I'm being challenged to report on anytime when a query "string" exists but doesn't have a value after the "=" character. The 3 query types should always exist, but apparently might not always have a value.

hoolio · Answer

If the query parameters are in the same order and consecutively listed, I think this will work: 
&nbsp;  
&nbsp; scan [string range [HTTP::query] [string first "s_sample=" [HTTP::query]] end] {s_sample=%[^&amp;]&amp;t_sample=%[^&amp;]&amp;u_sample=%[^&amp;]}  
&nbsp;  
&nbsp; A more robust option would be to parse each parameter name and value using URI::query.  But that seems like a lot of overhead if you're checking every request that has a query string.  If you're only interested in requests to a specific URI, you could check for that first before using the scan command. 
&nbsp;  
&nbsp; Aaron

chris_miller · Answer

Posted By hoolio on 11/02/2010 11:28 PM
&nbsp;
If the query parameters are in the same order and consecutively listed, I think this will work: &nbsp;
&nbsp; scan [string range [HTTP::query] [string first "s_sample=" [HTTP::query]] end] {s_sample=%[^&amp;]&amp;t_sample=%[^&amp;]&amp;u_sample=%[^&amp;]}  &nbsp;
&nbsp; A more robust option would be to parse each parameter name and value using URI::query.  But that seems like a lot of overhead if you're checking every request that has a query string.  If you're only interested in requests to a specific URI, you could check for that first before using the scan command. &nbsp;
&nbsp; Aaron

&nbsp;Actually, I do only care about a specific URI. Thanks for that tip!

Forum Discussion

Logging if certain HTTP Query Strings are Null

5 Replies

AppWorld Berlin iRules Contest!

F5 AppWorld 2026 Las Vegas - iRules Contest Winners!

Recent Discussions

Changes to DO and AS3 GitHub - no longer monitored

How to Verify config before loading to F5

Logical Disk Full to Migrate rSeries

HSL - Local TimeZone - in syslog server

VIP control across data centers - how to ensure only 1 VIP is up at a time?

Related Content

Logging/Blocking possible prompt injection

Intermediate iRules: Handling Strings

Forwarding Logs to SIEM Tools via HTTP Proxy for F5 Distributed Cloud Global Log Receiver

F5 Distributed Cloud Telemetry (Logs) - Loki

Logging DNS Requests

ABOUT DEVCENTRAL

RESOURCES

SUPPORT

PARTNERS