Forum Discussion
Eric_Robeson_27
Nimbostratus
NimbostratusLogging large headers
Hi,
I'm seeing errors like the following in my logs, and I would like to track down the headers that are triggering them. I don't know what the name of the header is that is triggering these errors, so I'm not sure how to write a rule to catch them. Ideally I would like to only log header name and contents when a certain size is hit.
May 9 04:03:13 tmm tmm[26953]: 011f0005:3: HTTP header (33670) exceeded maximum allowed size of 32768
Any ideas?
Thanks,
Eric
- Assuming the request is passing unmodified through the rule despite the error, this should work:
when HTTP_RESPONSE { set headers [HTTP::header names] foreach header_name $headers { if { [string length [HTTP::header $header_name]] > 32768 }{ log local0. "HTTP header [HTTP::header $header_name] ([string length [HTTP::header $header_name]]) exceeded maximum allowed size of 32768" } } } 
Eric_Robeson_27That did the trick, and I learned something too... Thanks!- excellent!
glad I could help
/deb - Kevin_O__39_NeiThis looks good. My question is how does one know which VIP to apply this rule to? We have many VIPs. Which one generated this event? Thanks.
...Kevin O'Neil
