For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Eric_Weiss_2486's avatar
Eric_Weiss_2486
Icon for Nimbostratus rankNimbostratus
Oct 19, 2017

Looking for iRule that logs source IP & destination URL when header "X-Application=SHARED"

Hello, I'm looking for an iRule that may already exist, which would log the source IP and URL destination when header “X-Application=SHARED”. The goal of this is to try and identify where an invali...
BIG-IP
iRules
security
Kevin_Davies's avatar
Kevin_Davies
Icon for Nacreous rankNacreous
Oct 20, 2017

Thats probably good for a single request however you are executing commands you don't need to. If you only need to check the first HTTP request in that connection (as their can be multiple) uncomment the event disable.

when HTTP_REQUEST {
    if { ([HTTP::header "X-Application"] eq "SHARED") } {
        log local0. "Client [IP::client_addr]:[TCP::client_port] -> [HTTP::host][HTTP::uri]"
         event disable
    }
}