For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Tracy_Butler_90's avatar
Tracy_Butler_90
Icon for Nimbostratus rankNimbostratus
Jul 06, 2006

writing an irule to log all traffic

Need assistance with writing an irule to log all traffic flow. Support suggested that this should be done versus making changes to the syslog-ng file. I've tried making changes to syslog-ng file wit...
application delivery
dev
devops
iRules
nitass's avatar
nitass
Icon for Employee rankEmployee
Oct 19, 2011
this is time. can you double check square bracket of HTTP::host? i think your irule is correct. 

when HTTP_REQUEST {
   set flag 0
   if {[HTTP::host] eq "172.28.17.33"} {
      set flag 1
      set http_request_time [clock clicks -milliseconds]
      set LogString "Client [IP::client_addr]:[TCP::client_port] -> [HTTP::host][HTTP::uri]"
   }
}

when HTTP_RESPONSE {
   if {$flag} {
      log local0. "$LogString (response) - pool info: [LB::server] - status: [HTTP::status] (request/response delta: [expr [clock clicks -milliseconds] - $http_request_time]ms)"
   }
}

Oct 19 21:15:07 local/tmm info tmm[4601]: Rule myrule : Client 192.168.206.102:65430 -> 172.28.17.33/ (response) - pool info: foo 10.10.70.110 80 - status: 200 (request/response delta: 3ms)
Oct 19 21:15:07 local/tmm info tmm[4601]: Rule myrule : Client 192.168.206.102:65430 -> 172.28.17.33/dog.gif (response) - pool info: foo 10.10.70.110 80 - status: 200 (request/response delta: 1ms)