wanna record user_agent from specific client ip

Aaron,

I know that Jucao was using the CLIENT_ACCEPTED event but is there any advantage to setting a variable in the CLIENT_ACCEPTED event in order to selectively log in the HTTP_REQUEST event as opposed to doing it all in one event? I am thinking something like:

when HTTP_REQUEST {
  if { [IP::client_addr] equals 174.76.19.40 } {
    log local0. "  174.76.19.40 uses [HTTP::header value user_agent]"
  }
}
 

Is there less overhead collecting the client IP in the CLIENT_ACCEPTED event?

Richard