I am wanting to send HTTP information to my syslog-ng server. I have tried to add logging to my iRule but I don't see any information being sent to the Local0 files on the F5. I would appreciate any help in setting up logging on a iRule. Thanks!

logging will go to /var/log/ltm unless you've specified in your log statements for it to go elsewhere.

Yes I am aware that it go to the LTM file..I am just not seeing any information in the file.

What does your rule look like? Perhaps your logging statements are never being called.

Copy of my iRule when HTTP_REQUEST { if { [HTTP::uri] contains "/Cust1" or [HTTP::uri] contains "/Cust2" or [HTTP::uri] contains "/Cust3"}{ pool WEB2-PICS } elseif { [HTTP::uri] contains "/Cust4" or [HTTP::uri] contains "/Cust5"}{ pool Prod_Web_Logic_7001 } elseif { [HTTP::uri] contains "/ABCDEFG"}{ HTTP::redirect https://www.domain.com/controller/ } else { HTTP::redirect http://www.domain.com/eStmtF5Error.html log local0. } }

Ahh. For the log command to function properly, you have to tell it what you want to log, not just tell it to log. So for instance, if you changed your log line to: log local0. "Redirection to Error page" Then you'd be able to see that message in your log file every time the rule processed that section of the code. HTH, -Colin

Logging to syslog from iRule

15 Replies

Colin_Walker_12
Historic F5 Account
Apr 06, 2006
It's true that the clock command's efficiency was greatly improved in 9.2. If you plan on using it extensively (in a control loop, for instance) then I would strongly suggest upgrading, as citizen_elah has mentioned.

-Colin
Thomas_Horn_921
Nimbostratus
Apr 07, 2006
So by default there are not any statistics sent to the ltm log file correct? In order to log information to that file an iRule needs to be created and the logging server restarted right? As I've mentioned in a previous post I'm interested in gathering some performance data, but haven't had a lot of success. The graphical representations are nice, but they don't offer much detail and having to extract data from the graph in order to pass it on is inaccurate and not fun. I've got a ticket in with support now as Colin suggested, but it seems like this information should be more readily available.
JRahm
Admin
Apr 07, 2006
The BigIP is a traffic management appliance, not a network management station. That said, the information you are requesting is available via SNMP and/or iControl. You can set up your NMS to poll the agents on the BigIP and graph as granular as you'd like. If you'd like a custom application for this, use iControl, it is well documented on this site.

It would be nice if the BigIP had a checkbox on the HTTP profile to enable webtrends or something similar...
Jeff_Morrison_4
Nimbostratus
Apr 07, 2006
At the risk of sounding stupid, what is iControl and how do I get it? Is it an addon to the BigIP or an additional item to purchase?
JRahm
Admin
Apr 07, 2006
iControl is the API for F5, it allows you to program against the LTM, so you can write custom apps to watch for a specific behavior, then possible alter the way the LTM is configured, or email/trap/page a technician, etc. Check out the iControl section of DevCentral!