Forum Discussion
Leslie_South_55
Nimbostratus
Nimbostratuswebalizer like reports from the LTM?
I know I may be reaching here, but I wonder if there is a way to get webalizer (http://www.mrunix.net/webalizer/) like reports from the LTM? We are using SNAT to connect to several weblogic servers, and even though I use the "insert x-forward-for" back to the servers, the weblogic logs seem to only capture the SNAT IP of the LTM. And since weblogic is more of an application server vs. a web server, these logs may not give me all the info that apache or IIS will.
Anyone have any ideas? Since the LTM is in the stream it would be nice to be able to generate data that could be viewed in a webalizer-like format.
Regards,
-L
- I remember seeing an iRule around that logged messages to syslog in the format of a webserver log for just this purpose. I'll have to see if I can dig it up.
-Joe - JRahm
Admin
This one, Joe?when HTTP_REQUEST { set http_request_time [clock clicks -milliseconds] set request_log_line "Client IP: [IP::remote_addr]:[TCP::remote_port], \ Vip IP: [IP::local_addr], \ requesting: [HTTP::method]/[HTTP::host][HTTP::uri], \ browser: [HTTP::header User-Agent], \ Referer: [HTTP::header value Referer], \ HTTP method: [HTTP::method], \ HTTP version [HTTP::version], \ JSESSION Cookie: [HTTP::cookie value JSESSIONID]" } when HTTP_RESPONSE { set http_response_time [ clock clicks -milliseconds ] log local0. "$request_log_line, \ HTTP status: [HTTP::status], \ Response Size: [HTTP::payload length], \ Duration: [expr $http_response_time - $http_request_time], \ Server IP: [LB::server addr]" } 
Leslie_South_55I have a version of this working how I want it now, using a snip from another rule found here. Question is, if I am logging the HTTP_RESPONSE, will I get log info for data that is served from RAMCACHE on the LTM?
-L- Leslie_South_55here is the rule I am using
when HTTP_REQUEST {
set curtime [clock seconds]
set formattedtime [clock format $curtime -format {%d/%b/%Y:%T %z}]
set log_format "[IP::client_addr] - - \[$formattedtime\] \"[HTTP::method] [HTTP::uri] HTTP/[HTTP::version]\""
}
when HTTP_RESPONSE {
log local0.info "$log_format [HTTP::status]"
} - sre_81614Hey lsouth!
I have the same problem and some question regarding it.
- Is this rule still working out for you or do you already have a better approach?
- Are you using a remote syslog where you log to?
- Do you also get log lines from objects hitting the RAM cache?
Greets,
Sascha - Leslie_South_55I had to abandon this logic as it was too expensive on our BigIP (TMM CPU was out of control) - if you have a VS that is not too busy, then it might work, but the VS I was monitoring had a sustaind connection count of over 2,000 and spiked to around 8,000 at times
We ended up moving to a comercial solution for user tracking and URL statistics.
-L
