Thanks again Aaron, I agree that STREAM_MATCHED would be too late. The volume of data I'm working on is 9964 bytes so definitely larger than the default allowed so I'm pretty sure now that is where the problem lies.
I've added the following to my iRule
when LB_SELECTED {
STREAM::max_matchsize 999999
}
This causes no syntax errors but is not resolving the issue, I've tried various smaller sizes also. I also notice that I always get to the same part of the code no matter what I set in this so I'd assume this is 4096 bytes in (though I've not checked that yet). Could the STREAM::disable statements be resetting this setting or something in my logic, if I'm correct iRule events process in the following order - HTTP_REQUEST, LB_SELECTED, HTTP_RESPONSE, STREAM_MATCHED but I've tried disabling the STREAM::disable in HTTP_RESPONSE but still no success.
I'll keep trying and update if I get to the bottom of it but if you've any further ideas, I'd be most grateful.
FYI, here is my current iRule.
when HTTP_REQUEST {
Explicitly disable the stream profile for each request so it doesn't stay
enabled for subsequent HTTP requests on the same TCP connection.
STREAM::disable
}
when LB_SELECTED {
STREAM::max_matchsize 999999
}
when HTTP_RESPONSE {
HTTP::header remove server
foreach header {Server Date X-Powered-By} {
while { [HTTP::header exists $header] } {
log local0. "Removing- $header: [HTTP::header value $header]"
HTTP::header remove $header
}
}
Disable the stream filter by default
STREAM::disable
Check if response type is text
if {[HTTP::header value Content-Type] contains "text"}{
Match and replace it with nothing
STREAM::expression {@comments.start.here.*>@@}
STREAM::expression {@comments.start.here.*comments.end.here>@@}
Enable the stream filter for this response only
STREAM::enable
}
}
when STREAM_MATCHED {
log local0. "1st MATCH [STREAM::match]"
Check if the matched string meets some condition that can't easily be checked for using a single regex in STREAM::expression
if {[STREAM::match] contains "Darren"}{
Replace Darren with XYXYXY and do the replacement
STREAM::replace "[string map {Darren XYXYXY} [STREAM::match]]"
log local0. "[IP::client_addr]:[TCP::local_port]: matched: [STREAM::match], replaced with: [string map {Darren XYXYXY} [STREAM::match]]"
log local0. "2nd MATCH"
}
}
Thanks
Darren