Forum Discussion
Jonathan_Landis
Nimbostratus
NimbostratusMultiple message-header fields with the same field-name
The following rule logs the "Cookie" header of http requests:
when HTTP_REQUEST {
set ch [HTTP::header "Cookie"]
if {$ch != ""} {log local0. "$ch"} else {log local0. "no cookie"...
According to RFC 2616 there should be one Accept header, with a list of the acceptable data types in it. Click here
This can be split up into seperate variables as needed with the list commands native to TCL once you pull the header value itself.
-Colin
