TCP payload match and logging

That's probably almost right if you're doing the searching yourself. Except you'll need to consider boundary conditions as well. For example the "userid=" string may be split across the border of the TCP data payload that you've gathered.

 

 

Perhaps an easier way would be to use stream processing. Setup a stream that looks for the patterns you're interested in, and trigger on the STREAM_MATCHED event. In there you can pull and log the values. (You can either define the stream in a profile, and attach it, or define the stream you're looking for at run time the way the ProxyPass iRule does... In fact for a good example of stream processing see the ProxyPass iRule).

 

 

H