writing an irule to log all traffic

Thanks, hoolio !

 

As always, this brings up another question.

 

Using this works great, but I'm getting some puzzling results from my testing.

 

Frequently, the BigIP says it took less time (between HTTP_REQUEST, and HTTP_RESPONSE) than IIS says it took to complete the request (as taken from the 'TimeTaken' field in the IIS logs.

 

Perhaps I don't fully understand the HTTP_RESPONSE - Could IIS still be sending data, and the F5 records the moment that it reads the header data, and not when the request is 'complete' ?

 

 

If so, is there a way to capture the completion of the request from the F5 perspective ?

 

 

Management suspicion is that the F5 is adding a high amount of overhead / latency to HTTP traffic, and I'm trying to refute this.

 

 

Thanks !