Payload display incorrect format

Hello,

 

Can you show us the irule that you use to retrieve payload?

 

Regards,

 

Hi, My Irule: when RULE_INIT { Log debug to /var/log/ltm? 1=yes, 0=no set static::payload_dbg 1 set static::log_local 0 Limit payload collection to 5Mb set static::max_collect_len 5368709120 HSL pool name set static::hsl_pool "ABC" Max characters to log locally (must be less than 1024 bytes) https://clouddocs.f5.com/api/irules/log.html set static::max_chars 900 } when CLIENT_ACCEPTED { set hsl [HSL::open -proto UDP -pool $static::hsl_pool] set clientip [IP::remote_addr] } when CLIENTSSL_HANDSHAKE { Identify the Client and negotiated cipher. } when SERVERSSL_HANDSHAKE { Identify the connected server and negotiated cipher. } when HTTP_REQUEST { set uri [HTTP::uri] set clientip [IP::client_addr] set host [HTTP::host] set method [HTTP::method]

 

     log each Header.
    if {[HTTP::method] eq "PUT"} {
        set req_payload [HTTP::payload]
        set a $req_payload
    }
    if {[HTTP::method] eq "POST"} {
        if {[HTTP::header exists "Content-Length"] && [HTTP::header "Content-Length"] <= 1048000} {
            set content_length [HTTP::header "Content-Length"]
        } else {
            set content_length 1048000
        }
        if { $content_length > 0 } {
            HTTP::collect $content_length
        }
    }
     Prevent the server from sending a compressed response
     remove the compression offerings from the client
    HTTP::header remove "Accept-Encoding"
     Don't allow response data to be chunked   
    if { [HTTP::version] eq "1.1" } {
        HTTP::version "1.0"
    }
}
when HTTP_REQUEST_DATA {

    if {[HTTP::method] eq "POST"} {
        set req_payload [HTTP::payload]
    }
    HSL::send $hsl "$clientip $host $uri $method $req_payload"
}

Thanks

 

Hello,

Can you try this:

binary scan [HTTP::payload] H* payload_hex
log local0. "payload_hex: $payload_hex"}

Just to be sure did you capture your post with your browser (with developer tools: f12)? this will allow you to check in what format (coding) the data is send. this will permit you to addapt your Irule an decoding it as well...

Regards

What was the wrong version logged?

 

It might help if you also log the content-type and charset of the request.

 

I guess if you capture both client side and syslog traffic with tcpdump, the data encoding will be the same.

 

The problem should be a decoding issue in syslog server!

 

If you want to convert text with an irule, you have to know what is the source encoding format and what is the expected target encoding format, then try to find encoding conversion code in tcl (or nodejs to use with irulelx)!