way to get away with truncated syslog

Hi friends,

 

 

I have written iRule script as:

 

 

when HTTP_REQUEST {

 

if {[HTTP::header value Content-Type] contains "application/vnd.syncml+xml"}{

 

set secs [clock seconds]

 

set msec [clock clicks -milliseconds]

 

set base [expr { $secs * 1000 } ]

 

set fract [expr { $msec - $base }]

 

if { $fract >= 1000 } {

 

set diff [expr { $fract / 1000 }]

 

incr secs $diff

 

incr fract [expr { -1000 * $diff }]

 

}

 

log local0. " [clock format $secs -format {%H:%M:%S}].$fract HTTP::payload: [HTTP::payload]"

 

}

 

}

 

when HTTP_RESPONSE {

 

if {[HTTP::header value Content-Type] contains "application/vnd.syncml+xml"}{

 

set secs [clock seconds]

 

set msec [clock clicks -milliseconds]

 

set base [expr { $secs * 1000 } ]

 

set fract [expr { $msec - $base }]

 

if { $fract >= 1000 } {

 

set diff [expr { $fract / 1000 }]

 

incr secs $diff

 

incr fract [expr { -1000 * $diff }]

 

}

 

log local0. " [clock format $secs -format {%H:%M:%S}].$fract HTTP::payload: [HTTP::payload]"

 

}

 

}

 

 

and syslog-ng.conf file is like

 

CUSTOM LOGGING FOR Performance Optimization App =======

 

filter f_local0 {

 

facility(local0) and not match(": ");

 

};

 

filter f_local0_customlog {

 

facility(local0) and match(": ");

 

};

 

destination d_customlog {

 

file("/var/log/customlog" create_dirs(yes));

 

};

 

log {

 

source(local);

 

filter(f_local0_customlog);

 

destination(d_customlog);

 

};

 

CUSTOM LOGGING FOR Performance Optimization App =======

 

Since request, response are more than 1024 bytes (syslog max size ), logs are truncated.

 

I tried the logging onto remote machine using udp ("ip_address" port (514)) but there also same problem persists.

 

So friend, is there any way to get full logs to deal with such scenario?

 

Is there any way to redirect the logs to remote machine before going to syslog ?

 

Can we invoke any perl/shell script from irule script itself ?

 

Else is there method to break the request & response break (I know rechunk/unchunk is possible for HTTP_REQUEST only) ?

 

please help me out from this.

 

I have to parse these logs in order to get the request-response time required for each operation & its status.

 

Thanks in Advance.