Forum Discussion

richarc's avatar
richarc
Icon for Nimbostratus rankNimbostratus
May 18, 2023

Unique Identifier for irules Http response

With code for an irule below is there a way I can set a unique identifier for the data coming back. I ask because when the logs are ingested into Splunk we would like to know which header came with w...
application delivery
  • Paulius's avatar
    Paulius
    May 19, 2023

    richarc With the iRule logging each time you receive an HTTP response this will be a significant amount of log entries. You might be better off with one logging line and having the server insert a unique ID per client rather than the F5. If you are using UIE persistence you might be able to do the following and use Splunk to merge the request and response somehow.

    when HTTP_REQUEST priority 500 {

   set value [persist lookup uie [list $myVar any virtual]]

   log local0. "HTTP reqeust client ID: ${value}"

}

when HTTP_RESPONSE priority 500 {

   set value [persist lookup uie [list $myVar any virtual]]

   log local0. "HTTP resposne client ID: ${value}"

}

     

richarc's avatar
richarc
Icon for Nimbostratus rankNimbostratus

Hello Paulius,

Thanks so much for your help.  I expect multiple header field names. Below is an example of the output and what I would like to capture. There is a delimiter between each capture, but in Splunk it see each line as a different response. 

 

 

Current output

/Common/http_response_capture <HTTP_RESPONSE>: =============================================
/Common/http_response_capture <HTTP_RESPONSE>: Client XX.XX.XX.XX:XXX (response) - status: 304
/Common/http_response_capture <HTTP_RESPONSE>: Date: Fri, 19 May 2023 11:39:59 GMT
/Common/http_response_capture <HTTP_RESPONSE>: Connection: Keep-Alive
/Common/http_response_capture <HTTP_RESPONSE>: Keep-Alive: timeout=15
/Common/http_response_capture <HTTP_RESPONSE>: ETag: "XXXXXXXXXXXX"
/Common/http_response_capture <HTTP_RESPONSE>: Cache-Control: max-age=XXXXX, public
/Common/http_response_capture <HTTP_RESPONSE>: =============================================

Would Like

/Common/http_response_capture <HTTP_RESPONSE>: UNIQ_ID =============================================
/Common/http_response_capture <HTTP_RESPONSE>: Client XX.XX.XX.XX:XXX (response) - status: 304 UNIQ_ID
/Common/http_response_capture <HTTP_RESPONSE>: Date: Fri, 19 May 2023 11:39:59 GMT UNIQ_ID
/Common/http_response_capture <HTTP_RESPONSE>: Connection: Keep-Alive UNIQ_ID
/Common/http_response_capture <HTTP_RESPONSE>: Keep-Alive: timeout=15 UNIQ_ID
/Common/http_response_capture <HTTP_RESPONSE>: ETag: "XXXXXXXXXXXX" UNIQ_ID
/Common/http_response_capture <HTTP_RESPONSE>: Cache-Control: max-age=XXXXX, public UNIQ_ID
/Common/http_response_capture <HTTP_RESPONSE>: =============================================

 

 

Paulius's avatar
Paulius
Icon for MVP rankMVP
May 19, 2023

richarc With the iRule logging each time you receive an HTTP response this will be a significant amount of log entries. You might be better off with one logging line and having the server insert a unique ID per client rather than the F5. If you are using UIE persistence you might be able to do the following and use Splunk to merge the request and response somehow.

when HTTP_REQUEST priority 500 {

   set value [persist lookup uie [list $myVar any virtual]]

   log local0. "HTTP reqeust client ID: ${value}"

}

when HTTP_RESPONSE priority 500 {

   set value [persist lookup uie [list $myVar any virtual]]

   log local0. "HTTP resposne client ID: ${value}"

}