Forum Discussion
MR_RJ
Cirrus
Nov 21, 2011Logging when there are multiple threads from one host
Hi,
I got a question from the development team that I doubt I can solve with a LTM but why not ask here, maybe anyone got a idea if it's possible at all.
We have a application (web...
MR_RJ
Cirrus
Dec 05, 2011when RULE_INIT {
array set ::customer_sourceip { }
}
when HTTP_REQUEST {
if { [HTTP::request_num] > 20 } then {
if { ([info exists ::customer_sourceip([IP::client_addr])]) } {
incr ::customer_sourceip([IP::client_addr])
log local0. "SourceIP - [IP::remote_addr] - SYSNAME_Threads_high [HTTP::request_num]"
}
else { set ::customer_sourceip([IP::client_addr]) 1 }
log local0. "SourceIP - [IP::remote_addr] - SYSNAME_Threads_high [HTTP::request_num]"
}
if { [HTTP::uri] starts_with "/ROB" } {
HTTP::respond 200 content [array get ::customer_sourceip]
set td_html ""
foreach {SRC_IPS CNT_HITS} [array get ::customer_sourceip] {
append td_html "$SRC_IPS$CNT_HITS"
}
append td_html ""
log local0. "ROOOOOOOOOOOOOOOB $td_html"
HTTP::respond 200 content $td_html
}
}
Sorry, here is the updated one. I did some changes when it didnt work as expected, that's why I removed the other variable in the forearch statement. But since there is a bug causing the forearch with array to not work as expected, I dont know how to do a work around. Saw something about Tables, going to take a look at it shortly.
The output right now is for example: (IP IP, and on next row, COUNT COUNT)
127.0.0.1 127.0.0.1
135 135
In the other article they referred to a know issue ID, but I haven't been able to find out if it's been fixed in later releases.
-----
Michael: About the log thingy, I tried it but since there is no syntax checking on the log separating... the syntax looked good to me (copy paste basically) it didnt work when I tried to restart syslog. And the command gives a clear warning not to use it without F5 support assistant.
Thanks!
//R
Recent Discussions
Related Content
DevCentral Quicklinks
* Getting Started on DevCentral
* Community Guidelines
* Community Terms of Use / EULA
* Community Ranking Explained
* Community Resources
* Contact the DevCentral Team
* Update MFA on account.f5.com
Discover DevCentral Connects