When to use HTTP::uri vs HTTP::path, contains vs matches

What I'd recommend doing is logging each one to see what data each returns, so you know which data set you actually want to work with.

A simple rule like this would do the trick:

when HTTP_REQUEST {
  log local0. "This is the HTTP URI [HTTP::uri]"
  log local0. "This is the HTTP Path [HTTP::path]"
}

In this case, you should find that while HTTP::uri returns the entire uri string following the hostname, HTTP::path returns only the "path" of the uri, up to the filename of the request, I.E. nothing after a "?" in the URI.

So it sounds like, in your case, you'll want to use the HTTP::path.

As to the question regarding contains, well, contains would cetainly work in this case, as it allows for the item you're searching for to occur anywhere within the string. It is, however, one of the least efficient search operators. Since we've determined that the HTTP::path variable will return a string that ends with the filname, it would be far more efficient to use that to your advantage and put the "ends_with" operator to use.

Something like this, I would think:

when HTTP_REQUEST {
  if { [HTTP::path] ends_with ".php" } {
    pool php_pool
  }
}

Hopefully that'll get you where you need to go.

-Colin