Forum Discussion
NimbostratusOnly log for specific client IP
Looking for a little help. I have used a debug irule for a while but I am trying to modify it that the only time it logs is when it matches a client ip in a data group:
Here is my data group:
ltm data-group internal /Common/client_ip {
records {
192.168.1.4/32 { }
}
type ip
And here is my irule:
when CLIENT_ACCEPTED {
Check the client_ip datagroup to see whether this is a client IP address we want to log for
if { [matchclass [IP::remote_addr] equals $::client_ip] }{
set log_connection 1
Log the start of a new TCP connection
log "New TCP connection from [IP::client_addr]:[TCP::client_port] to [IP::local_addr]:[TCP::local_port]"
} else {
set log_connection 0
}
}
when HTTP_REQUEST_SEND {
If we're not logging for this client IP, exit this event in this iRule
if {$log_connection != 1}{ return }
set debug_client_addr [clientside {IP::client_addr}]
set debug_client_port [clientside {TCP::client_port}]
set debug_client "$debug_client_addr:$debug_client_port"
set debug_snat_addr [serverside {IP::client_addr}]
set debug_snat_port [serverside {TCP::client_port}]
set debug_snat "$debug_snat_addr:$debug_snat_port"
set debug_server_addr [serverside {IP::server_addr}]
set debug_server_port [serverside {TCP::server_port}]
set debug_server "$debug_server_addr:$debug_server_port"
set debug_virtual [clientside {virtual name}]
set debug_uri [clientside {HTTP::uri}]
set debug_pool [LB::server pool]
log local0. "Client $debug_client sends URI $debug_uri to Virtual $debug_virtual, selected Pool $debug_pool, will use connection from SNAT $debug_snat to Server $debug_server"
}
I am getting the following error:
TCL error: /Common/log - can't read "::client_ip": no such variable while executing "matchclass [IP::remote_addr] equals $::client_ip"
Any suggestions would be greatly apprecated.
3 Replies
- Kevin_Stewart
Employee
Assuming this is a newer system (v10+), you don't need the "$::" syntax to read a data group. The following should work:[matchclass [IP::client_addr] equals client_ip] -- or -- [matchclass [IP::client_addr] equals /Common/client_ip] 
BHouse_123286That did the trick. This is on 11.3. Thanks a lot for the help.- BHouse_123286That did the trick. This is on 11.3. Thanks a lot for the help.
