Logging to syslog from iRule

logging will go to /var/log/ltm unless you've specified in your log statements for it to go elsewhere.

 

Yes I am aware that it go to the LTM file..I am just not seeing any information in the file.

What does your rule look like? Perhaps your logging statements are never being called.

Copy of my iRule

 

 

when HTTP_REQUEST {

 

if { [HTTP::uri] contains "/Cust1"

 

or [HTTP::uri] contains "/Cust2"

 

or [HTTP::uri] contains "/Cust3"}{

 

pool WEB2-PICS

 

} elseif { [HTTP::uri] contains "/Cust4"

 

or [HTTP::uri] contains "/Cust5"}{

 

pool Prod_Web_Logic_7001

 

} elseif { [HTTP::uri] contains "/ABCDEFG"}{

 

HTTP::redirect https://www.domain.com/controller/

 

} else {

 

HTTP::redirect http://www.domain.com/eStmtF5Error.html

 

log local0.

 

}

 

}

Ahh.

 

 

For the log command to function properly, you have to tell it what you want to log, not just tell it to log.

 

 

So for instance, if you changed your log line to:

 

 

log local0. "Redirection to Error page"

 

 

Then you'd be able to see that message in your log file every time the rule processed that section of the code.

 

 

HTH,

 

-Colin

Thanks a lot for the help. Can you tell me how I would send ALL HTTP traffic to the LTM file so I can moitor it?

Well, first of all, I'm not sure you really want to pass all HTTP traffic to the LTM log, unless it's for a short period of testing or something to that effect.

Second, you can send any information you want to the log, but there isn't a command to generate a standardized log formatted entry.

So, you can create your own logging string, and have it fire for every HTTP_REQUEST event if that's what you're trying to track (like most webservers do).

This would simply be something like:

when HTTP_REQUEST {
  log local0. "[IP::client_addr] - [clock format $time_now -format {%d/%m/%Y:%H:%M:%S}] [HTTP::request]"
}

Of course you'd want to configure the logging string to fit your needs.

Colin

Thanks Colin...

 

 

I tried you exact syntax and I get the following error in the LTM file.

 

 

TCL error: Rule iRule_Test - can't read "time_now": no such variable while executing "clock format $time_now -format {%d/%m/%Y:%H:%M:%S}"

Additionally, you can read more about the clock command, which is a default TCL command, here: Click here

 

 

-Colin

I seem to remember unRuleY mentioning that you should be on 9.2 if you are going to use the clock command in production... just an FYI.