Forum Discussion
Kevin_Stewart
May 22, 2014Employee
Try this:
when HTTP_REQUEST {
set LogString_L1 "Client [IP::client_addr]:[TCP::client_port] URL: [HTTP::host][HTTP::uri]"
STREAM::disable
}
when HTTP_RESPONSE {
if { [HTTP::header Content-Type] contains "text" } {
set LogString_L2 "$LogString_L1 - status: [HTTP::status]"
STREAM::enable
}
}
when STREAM_MATCHED {
log -noname 192.168.222.63 local7.debug "INTERNAL FOUND STREAM MATCH '[STREAM::match]' originating from $LogString_L2"
}