Forum Discussion
al_kabeer_2905
Nimbostratus
NimbostratusMonitor All BigIP Traffic
Hi, I have bigip 3600 ltm, i created VIP (layer 4) for two web servers,
i want to log all traffic (http), i have created syslog server i can only see traffic for syn, pool up/down, node up/down.
but not the actual data.
how can i monitor this traffic and what software best suite ?
thanks
4 Replies
What_Lies_Bene1Cirrostratus
Just so we're clear, you want to have a copy of ALL the traffic handled by the VS?- nitass
Employee
these are some examples in CodeShare.
Log Tcp And Http Request Response Info by Aaron
https://devcentral.f5.com/wiki/irules.logtcpandhttprequestresponseinfo.ashx
Log Tcp And Http Request Response Info Remotely by Aaron
https://devcentral.f5.com/wiki/irules.Log-Tcp-And-Http-Request-Response-Info-Remotely.ashx
hope this helps. 
al_kabeer_2905I am network person, i usually type show logging or use netflow to collect data. Is there anything i can do to get the same.
IRule i tried i cannot insert Irule in l4 VIP since it needs http profile
thanks- nitassI am network person, i usually type show logging or use netflow to collect data. Is there anything i can do to get the same.system log does not contain application traffic. there is sflow in 11.2.0.
Manual Chapter: Configuring Performance Monitoring
http://support.f5.com/kb/en-us/products/big-ip_ltm/manuals/product/tmos-implementations-11-2-0/23.htmlconceptid
IRule i tried i cannot insert Irule in l4 VIP since it needs http profile http log requires http profile (since it has to parse http header). if you want to log just ip and port, you can use tcp or udp log instead which does not require http profile.
Log Http Tcp Udp To Syslogng
https://devcentral.f5.com/wiki/iRules.LogHttpTcpUdpToSyslogng.ashx
for high volume of traffic, high speed logging is prefered (instead of log command).
High Speed Logging
https://devcentral.f5.com/wiki/irules.HSL.ashx
