Forum Discussion

oguzy's avatar
oguzy
Icon for Cirrostratus rankCirrostratus
Sep 01, 2021

Re: log for iRules:Data Group List

Hi Muhammad Tanvir,

I think your irule is almost correct. Did it not work as you expected? I assume that as you already have a data group list named as "smtp_relay_allowed", initial checking of existence of this data group is not necessary. For simplicity;

when CLIENT_ACCEPTED {
  set accepted_snat "172.16.0.174"
  if { [class match [IP::client_addr] equals smtp_relay_allowed] } {
    snat $accepted_snat
    log local0. "IP allowed to relay: [IP::client_addr]"
  } else {
      snat automap
      log local0. "IP not allowed to relay: [IP::client_addr]"
  }
}

3 Replies

  • muhammad_Tanvir's avatar
    muhammad_Tanvir
    Icon for Nimbostratus rankNimbostratus

    Thanks Oguzy for your kind reply.

    I rule works fine.

     

    I want to update the data group list which has 172 IPs. List is 4 years old and a lot of systems are gone now. Before I update the list I want to enable logs and find out which systems are still actively using the virtual server

     

    Could you please help me out to find out which logs I need to configure to capture IPs. There are many types Kind regarfds

    Tanvir

     

    • oguzy's avatar
      oguzy
      Icon for Cirrostratus rankCirrostratus

      Hi Tanvir,

      As we specify "log local 0.", you should check "Local Traffic" Log on GUI or /var/log/ltm file on CLI. You can use both GUI and CLI. If you use CLI, you can check rotated (old ltm) logs via regex.

      If you login via ssh to your BIG-IP device, you can try the following command:

      grep "IP allowed to relay" /var/log/ltm*

      Then you can inspect the IP address requesting to your virtual server.