For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Eric_Weiss_2486's avatar
Eric_Weiss_2486
Icon for Nimbostratus rankNimbostratus
Oct 19, 2017

Looking for iRule that logs source IP & destination URL when header "X-Application=SHARED"

Hello, I'm looking for an iRule that may already exist, which would log the source IP and URL destination when header “X-Application=SHARED”. The goal of this is to try and identify where an invali...
BIG-IP
iRules
security
Eric_Weiss_2486's avatar
Eric_Weiss_2486
Icon for Nimbostratus rankNimbostratus
Oct 19, 2017

Nevermind, I was able to put one together. Here it is:

 

when HTTP_REQUEST { set LogStringNonProd "Client [IP::client_addr]:[TCP::client_port] -> [HTTP::host][HTTP::uri]" Check for 'X-Application: SHARED' if { ([HTTP::header value "X-Application"] contains "SHARED") } { log local0. " " log local0. "===================================================" log local0. "$LogStringNonProd (request)" log local0. "X-Application is set to SHARED for this connection." log local0. "===================================================" log local0. " " } }