For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Tracy_Butler_90's avatar
Tracy_Butler_90
Icon for Nimbostratus rankNimbostratus
Jul 06, 2006

writing an irule to log all traffic

Need assistance with writing an irule to log all traffic flow. Support suggested that this should be done versus making changes to the syslog-ng file. I've tried making changes to syslog-ng file wit...
application delivery
dev
devops
iRules
hoolio's avatar
hoolio
Icon for Cirrostratus rankCirrostratus
Aug 10, 2010
Hi Thomas,

 

 

I believe the problem is that the client waits for the server to send a message first. So there isn't any client data to collect initially. Spark described an option to use the skip_bytes flag on TCP::collect to handle this sort of scenario:

 

 

http://devcentral.f5.com/Forums/tabid/1082223/asg/50/showtab/groupforums/aff/5/aft/24911/afv/topic/Default.aspx25028

 

 

However, there might be a simpler option if all you want to do is look for APPEND in the request payloads. You might be better off using a blank stream profile and iRule which applies the stream filter only on requests and logs in the STREAM_MATCHED event. You could try enabling the stream filter using STREAM::enable in CLIENT_ACCEPTED and then disabling it in LB_SELECTED or SERVER_CONNECTED.

 

 

http://devcentral.f5.com/wiki/default.aspx/iRules/stream

 

 

Aaron