Forum Discussion
NimbostratusRequest logging - log backend server name
CumulonimbusI had the same problem, looking to log the "Host:" header of the incoming request with the request logging profile. TAC advised me to use an irule instead for this purpose.
Andrew_NascimenJG, using request logging for the "Host" header is actually very straight forward. "$Host" will work.
This is what my current request logging template looks like, json formatted:
{"DATE":"$DATE_MM/$DATE_DD/$DATE_YY", "TIME":"$TIME_MSECS", "CIP":"$CLIENT_IP", "VIP":"$VIRTUAL_IP", "PORT":"$VIRTUAL_PORT", "BACKENDPOOL":"$VIRTUAL_POOL_NAME", "BACKENDSERVER":"$SERVER_IP", "BACKENDPORT":"$SERVER_PORT", "METHOD":"$HTTP_METHOD", "HOST":"$Host", "PATH":"$HTTP_PATH", "QUERY":"$HTTP_QUERY", "STATUS":"$HTTP_STATCODE", "REFERER":"$Referer", "USERAGENT":"${User-agent}", "SESSIONID":"${Cookie[SESSION]}", "XFF":"${X-Forwarded-For}", "LOCATION":"${Location}", "URI":"$HTTP_URI"}
I historically have had issues with using an iRule for logging. It also means that I need to bind that iRule to every single VIP - which isn't as scalable as enabling a request logging profile with the default setting turned on.
Hopefully, this helps you out.
- JG
Are you sure it logs the "Host" header in the request and not the name of the F5 virtual server? To me, it seems it should be called something like "HTTP_HOST" instead. if it does work, it is certainly not documented for this profile of request logging, and F5 TAC knew nothing about it when I asked them.
- Andrew_Nascimen
Positive (if you want screen captures I can set up a quick test).
If you want to log the VIP Name, $VIRTUAL_NAME is the variable you are looking for.
$Host will capture the host header. It is undocumented in the article I linked above. I just experimented because of the column "Log entry file description" for the $NCSA_COMBINED variable contained a couple of headers.
The one thing I found strange about logging the headers is it seems to allow "$Host" and ${Host}.
Looking at my code above I am inconsistent:
ex. I use $Host and ${Location}.
I should be consistent and instead use:
${Host} and ${Location} -or- $Host and $Location
I'm thinking that I am going to update my template though to be "${Host}" and "${Location}".
Apart from the "consistency" argument, there is another reason to use the curly braces. Also currently undocumented, but an engineer is working on getting the documentation updated.
If you try logging the "Cookie" header - you'll realize it captures the entire contents of the header. Which can be rather cumbersome and unsightly, and not very helpful if you're trying to log one cookie in particular and gather metrics on it. The fix (shown in my template above) is to wrap the header in curly braces and the specific cookie in brackets - see below:
"${Cookie[SESSION]}"
This will explicitly log just the session cookie, should it exist.
Hopefully that helps.
