For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

yarivco_99951's avatar
yarivco_99951
Icon for Nimbostratus rankNimbostratus
Nov 09, 2009

Sent to ouside syslog using iRule

Hi all,

 

My first time here.

 

Can anyone help to erite an irule which send out log each time an IP is connected to virt.(indlude th src ip addv and des real server)

 

 

I got complaint that at the application log they sees same ip jump btween two reals server despite i am using a source Ip PRESIST PROFILE.

 

 

TNX all
application delivery
dev
devops
iRules

3 Replies

  • The_Bhattman's avatar
    The_Bhattman
    Icon for Nimbostratus rankNimbostratus
    Nov 09, 2009
    I believe you can use the following sample code.

     

     

    http://devcentral.f5.com/wiki/default.aspx/iRules/In_Depth_Traffic_Analysis_via_iRule.html

     

     

    Just cut out information you don't want to log

     

     

    I hope this helps

     

     

    CB

     

     

     

  • hoolio's avatar
    hoolio
    Icon for Cirrostratus rankCirrostratus
    Nov 09, 2009
    In addition to CB's useful suggestion, you can also use the 'log ' option in 9.4 and higher to bypass syslog-ng and send syslog messages directly to a remote syslog server:

     

     

    iRules Update: The "log" command gets new options

     

    http://devcentral.f5.com/Default.aspx?tabid=63&articleType=ArticleView&articleId=190

     

     

    And here is another Codeshare example which logs IP:port details for TCP/HTTP/UDP VIPs:

     

     

    http://devcentral.f5.com/wiki/default.aspx/iRules/LogHttpTcpUdpToSyslogng

     

     

    Aaron