For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Heino's avatar
Heino
Icon for Cirrus rankCirrus
Jul 05, 2019

Request Logging missing SERVER_IP

Using various devcentral articles and the Request Logging Profiles article I've made this template request logging template. It works pretty well, aside from the bold variables. I really need the $SERVER_IP and $SERVER_PORT information. Any ideas to why server and port isn't logged?

 

TMOS version: 13.1.1.5

Request Logging Profile:

Parent: request-log

Request Logging: Enabled

Template: $DATE_NCSA, $CLIENT_IP, $CLIENT_PORT, $VIRTUAL_IP, $VIRTUAL_PORT, $VIRTUAL_NAME, $VIRTUAL_POOL_NAME, $SERVER_IP, $SERVER_PORT, "$HTTP_PATH", "$HTTP_REQUEST", $HTTP_STATCODE, $RESPONSE_SIZE, $RESPONSE_MSECS, "$Referer", "${User-agent}"

HSL Protocol: TCP

Pool Name: syslog_pool

 

Example from the server

client: 203.0.113.245

vIP: 192.168.132.132

server: 172.17.17.15

[05/Jul/2019:12:28:26 +0200], 203.0.113.245, 2825, 192.168.132.132, 443, company_sales_https_vs, , , , "/Assets/Portal/Applications/applications.min.js", "GET /Assets/Portal/Applications/applications.min.js?q=1507g512 HTTP/1.1", , , , "https://domain.local/news/2018/nov/station/", "Mozilla/5.0 (Linux; Android 8.1.0; SM-J530F) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.101 Mobile Safari/537.36"

 

1 Reply

  • If you were trying to log this information from an iRule, I would say that you've probably chosen the wrong event to log from, e.g. you are trying to log information about the server-side connection before a load-balancing decision has been made. I wonder if you would have more success if you enabled this a response logging behavior?