wanna record user_agent from specific client ip

ok,yes,it will affect the process,

 

Actually I visit the vs,if it hit this irule,it will show error due to can't process with the irule more.

 

The webpage can't be open

 

ok,I take a capture and rst are sent from server side,it is cool

 

you are an expert in this ,

 

thanks ,I will avoid this in the other irule

 

 

capture with respect to romoving else clause in this irule.

 

 

No. Time Source Destination Protocol Info

 

5 2.255425 10.80.8.91 10.80.2.73 TCP 25186 > http [SYN] Seq=0 Ack=0 Win=64240 Len=0 MSS=1460

 

6 2.256188 10.80.2.73 10.80.8.91 TCP http > 25186 [SYN, ACK] Seq=0 Ack=1 Win=4140 Len=0 MSS=1380

 

7 2.256216 10.80.8.91 10.80.2.73 TCP 25186 > http [ACK] Seq=1 Ack=1 Win=64240 Len=0

 

8 2.256339 10.80.8.91 10.80.2.73 HTTP GET / HTTP/1.1

 

9 2.257416 10.80.2.73 10.80.8.91 TCP http > 25186 [ACK] Seq=1 Ack=948 Win=5087 Len=0

 

10 2.257429 10.80.2.73 10.80.8.91 TCP http > 25186 [RST, ACK] Seq=1 Ack=948 Win=5087 Len=0

 

Thanks for confirming. It's generally a good idea to ensure variables are set in all cases. Or you can use info exists to check. But it's additional complexity with little benefit.

when CLIENT_ACCEPTED {
   if { [IP::addr [IP::client_addr] equals 174.76.19.40] } {
      set log_ua 1
   }
}
when HTTP_REQUEST {
   if { [info exists log_ua] && $log_ua == 1 } {
      log local0. " 174.76.19.40 uses [HTTP::header value user_agent]"
   }
}

Aaron

yes,I will follow your instructions to add else

 

by the way, can I use else in this synatx:

 

when CLIENT_ACCEPTED {

 

if { [IP::addr [IP::client_addr] equals 174.76.19.40] } {

 

set log_ua 1

 

} else {set log_ua 0}

 

}

 

when HTTP_REQUEST {

 

if { $log_ua == 1 } {

 

log local0. " 174.76.19.40 uses [HTTP::header value User-Agent]"

 

} else { $log_ua == 0 }

 

{log local0. "[IP::client_addr] uses [HTTP::header value User-Agent]"}

 

}

 

it seems it doesn't work,so it is not allowed to add match condition after else ,right?

 

but irule below does work.

 

when CLIENT_ACCEPTED {

 

if { [IP::addr [IP::client_addr] equals 174.76.19.40] } {

 

set log_ua 1

 

} else {set log_ua 0}

 

}

 

when HTTP_REQUEST {

 

if { $log_ua == 1 } {

 

log local0. " 174.76.19.40 uses [HTTP::header value User-Agent]"

 

} elseif { $log_ua == 0 } {log local0. "[IP::client_addr] uses [HTTP::header value User-Agent]"}

 

}