Tracking session in soap header?

Deb's rule is close, but missing a closing bracket on the last functional line.

when HTTP_REQUEST {
   collect the payload containing the POST data
  HTTP::collect [HTTP::header Content-Length]
}
when HTTP_REQUEST_DATA {
   persist on data from 59th character following 'xmlns:soapenc=' up to "<"
   and follow existing persistence record or create a new one
  persist uie [findstr [HTTP::payload] "xmlns:soapenc=" 58 "<"]
}

If you haven't tried it with that closing bracket, I'd give that a shot. If you have and it's still not working, then yes, you can absolutely output what's being returned to the log file. You'd do so like:

when HTTP_REQUEST {
   collect the payload containing the POST data
  HTTP::collect [HTTP::header Content-Length]
}
when HTTP_REQUEST_DATA {
   persist on data from 59th character following 'xmlns:soapenc=' up to "<"
   and follow existing persistence record or create a new one
   persist uie [findstr [HTTP::payload] "xmlns:soapenc=" 58 "<"]
  log local0. "[findstr [HTTP::payload] 'xmlns:soapenc=' 58 '<']"
}

HTH,

Colin