Forum Discussion

al_kabeer_2905's avatar
al_kabeer_2905
Icon for Nimbostratus rankNimbostratus
Oct 23, 2012

Monitor All BigIP Traffic

Hi, I have bigip 3600 ltm, i created VIP (layer 4) for two web servers,

 

i want to log all traffic (http), i have created syslog server i can only see traffic for syn, pool up/down, node up/down.

 

but not the actual data.

 

how can i monitor this traffic and what software best suite ?

 

thanks

 

management
monitoring

4 Replies

  • nitass's avatar
    nitass
    Icon for Employee rankEmployee
    Oct 23, 2012
    these are some examples in CodeShare.

     

     

    Log Tcp And Http Request Response Info by Aaron

     

    https://devcentral.f5.com/wiki/irules.logtcpandhttprequestresponseinfo.ashx

     

     

    Log Tcp And Http Request Response Info Remotely by Aaron

     

    https://devcentral.f5.com/wiki/irules.Log-Tcp-And-Http-Request-Response-Info-Remotely.ashx

     

     

    hope this helps.
  • al_kabeer_2905's avatar
    al_kabeer_2905
    Icon for Nimbostratus rankNimbostratus
    Oct 24, 2012
    I am network person, i usually type show logging or use netflow to collect data. Is there anything i can do to get the same.

     

     

    IRule i tried i cannot insert Irule in l4 VIP since it needs http profile

     

     

    thanks
  • nitass's avatar
    nitass
    Icon for Employee rankEmployee
    Oct 24, 2012
    I am network person, i usually type show logging or use netflow to collect data. Is there anything i can do to get the same.system log does not contain application traffic. there is sflow in 11.2.0.

     

     

    Manual Chapter: Configuring Performance Monitoring

     

    http://support.f5.com/kb/en-us/products/big-ip_ltm/manuals/product/tmos-implementations-11-2-0/23.htmlconceptid

     

     

    IRule i tried i cannot insert Irule in l4 VIP since it needs http profile http log requires http profile (since it has to parse http header). if you want to log just ip and port, you can use tcp or udp log instead which does not require http profile.

     

     

    Log Http Tcp Udp To Syslogng

     

    https://devcentral.f5.com/wiki/iRules.LogHttpTcpUdpToSyslogng.ashx

     

     

    for high volume of traffic, high speed logging is prefered (instead of log command).

     

     

    High Speed Logging

     

    https://devcentral.f5.com/wiki/irules.HSL.ashx