Referred by the iRule group - Logging

iControl is the Management API on our devices. It's a SOAP interface that is included with each version of the product. In the downloads section of this website you can get the SDK that documents each of the methods that are exposed.

 

 

iControl is used for device management (configuration, statistics, etc). Think of it as if you wanted to write your own version of the GUI or CLI.

 

 

iRules is the internal scripting language that allows access to data in the packet path. What you are asking about sending HTTP info into the log file is done via iRules, not iControl.

 

 

If you have a specific question about iRules, I'd suggest you look in the iRules Wiki on this site. There is documentation for the iRules methods we support as well as a bunch of code samples.

 

 

Hope this helps...

 

 

-Joe

Ok, I just saw your post on the iRules forum so I've got some context for your question. If you could post exactly what you want to accomplish, we can let you know the best way to get it done.

 

 

With iControl, you can build a client app that pulls any statistics available from the device into your application. You can then choose to store that in any way you desire. Maybe that's what you are getting at.

 

 

-Joe

If he's not I am... I've got a ticket in with support as Colin recommended, so you may not want to spend a long time on this. Additonally, I've just downloaded the iControl SDK and have yet to evaluate it's contents. With any luck one of these avenues will solve my problem, but at any rate here's what I'm looking to get done:

 

 

I'm interested in putting together some historical data with regards to connections, times, IP's, etc. and can't find a good way to retreive that data in the web admin portion of the BIG-IP systems. I'm wondering a couple things:

 

 

1. How long does the OS hold historical data?

 

2. What are my options for retreving and formatting the stored data?

 

3. Do I need to setup a syslog server and iRules to log these type of requests or is something built into the OS?

 

 

For instance, here's a couple queries I'd like to have results for:

 

 

1. IPaddy; Connection time; Total HTTPS requests; Session Time

 

 

2. Total connections for time period; connections per day for time period; IP addresses for time period

 

 

Thanks for any help you can provide.

Ok, I'll try to address your questions one at a time.

 

 

1. How long does the OS hold historical data?

 

The BIG-IP as a rule doesn't store historical data. Only current values and averages are stored for the traffic. The performance graphs in the Overview section of the GUI) are the only exception to this rule. The data here is compressed over time similar to how MRTG stores it's historical data. Currently this is in a compressed file and is accessible via the iControl System::Statistics interface if you want to get to the raw data in CSV format.

 

 

2. What are my options for retreving and formatting the stored data?

 

The only stored data as I mentioned above is the data behind the performance graphs. The SDK includes a perl sample (performanceGraphs.pl) that will query the data behind the performance graphs. Keep in mind that this is not all the data you may be interested in, just the data we've included in the performance graphs.

 

 

3. Do I need to setup a syslog server and iRules to log these type of requests or is something built into the OS?

 

Not sure I really get this question. The best way to build a log of historical data is not to use iRules and syslog, but to build an iControl application outside of the BIG-IP that pulls the data your are interested in over time. All of our statistics methods include timestamps to aid in your historical storage.

 

 

As for your specifics, the source for all your data is available via our iControl interfaces. For some of your data points you will have to store a combination of total or current values and calculate the values for your report.

 

 

Hope this helps...

 

 

-Joe

Thanks Joe! I'll take a few beers and the weekend to process this information and poke around a bit. It appears I've got some programming to learn in order to get these reports functioning.

Have one on me!

 

 

http://beer.trash.net/beerget.php?yourbeer=114444472710746122

 

Click here

 

 

-Joe

Is there any way to change when the logs are flushed? My F5 flushes the logs at 4am. Unless I check the local traffic logs before 4am, they all reset and I don't know what the problem is. Our F5s reboot every week early in the morning and by the time I get in to check it out they have rebooted and the logs are erased. Thanks for your help!

Hey Sloopjw,

 

This is actually handled by cron and syslog-ng. Deb Allen tells me there is a document on ask.f5.com that details how to configure the time for logrotate if that's the problem (flushing actually occurs based upon number of lines, not time, so I assume the rotate is the problem).

 

 

Hope that helps!

 

Don.