reg: Log statements printing twice

Pradeep,

 

 

Can you be more explicit? What event is the log statement under and how are you testing? Can you send the iRule?

 

Yeah,

 

in when HTTP_REQUEST

 

 

if {$::posDebug >= 3} {

 

log local0.info "10.0000 - Entering HTTP_REQUEST, IP: [IP::client_addr], SSL sid: [SSL::sessionid], URI: [HTTP::uri], requestPath: $requestPath"

 

log local0.info "10.0020 - POSSPC cookie: [HTTP::cookie POSSPC] IP: [IP::client_addr]"

 

log local0.info "10.0021 - User-Agent:[HTTP::header User-Agent] IP: [IP::client_addr]"

 

}

 

 

when CLIENT_CLOSED {

 

if {$::posDebug >= 3} {

 

log local0.info "50.00 - Entering CLIENT_CLOSED IP: [IP::client_addr]"

 

}

 

}

 

All the log statements are having printing twice.the above two are just examples.

 

 

these

Second question:

 

 

Does the [HTTP::uri] log return the same value? Your browser may be making multiple requests (pipelining) or you're requesting the favicon.

 

Is it what you are pointing on ??

 

 

if {$::posDebug >= 2} {

 

if {[string match "*favicon*" $http_uri]} {

 

log local0.info "10.0200 - See request for favicon.icn: $http_uri IP: [IP::client_addr]"

 

}

I'm just asking if, in your first log line:

 

 

log local0.info "10.0000 - Entering HTTP_REQUEST, IP: [IP::client_addr], SSL sid: [SSL::sessionid], URI: [HTTP::uri], requestPath: $requestPath"

 

 

the HTTP::uri statement is returning the same value every time. Or more specifically, is the entire log message the same (IP, SSL ID, URI, and requestPath)?

 

 

No, It differs most of the times, as there is SSL renegotiation and URL redirection like cases.

Let me rephrase the question. You said that all of the log statements are firing twice. My question is, when they fire twice, do they contain the SAME log information? When does it fire twice? In the beginning or on every request?

Yes, they contain the same log information. everything same, with time stamp also.

syslog config issue maybe?

That's my guess too Mohamed. Also try the following:

 

 

1. Run a wireshark capture to see if it's actually sending syslog data twice.

 

2. Test with the local syslog facility: local0.