Using iRules to edit datagroups

There's any number of ways to manage the values in a datagroup, but ultimately it comes down to immediacy.

 

 

Do you need the data available in or near real time? If so then a table structure is probably more viable. As stated, the session table is mirrored across peers, so it'd likely survive a reboot, but probably not an upgrade.

 

 

To update a datagroup, you could:

 

 

1. use the Syslog method as noted by Nitass.

 

 

2. use a sideband call to some (potentially custom) service on the BIG-IP that can touch the datagroup from the management shell. I've used netcat, a mini web server, and a few other options in this regard.

 

 

3. add entries to a table and create an internal service VIP that a monitor can periodically poll for new data to record to the datagroup.

 

 

There are of course many other options, but all have one important thing in common: peril...

 

 

Datagroups are only writable from the management shell, so any attempt to access them from TMOS means you have to build a connector from an area of live user traffic to an otherwise secure untouchable platform. You must then take measures to secure that connector so that it can't be manipulated beyond what is intended. There's also only one management kernel compared to potentially many TMM cores, so it would never scale to handle massive user traffic loads.

 

 

Option 3 above is perhaps one of the better options (IMHO). You can access the table for real time data, but also allow it to be archived indefinitely in a datagroup.