writing an irule to log all traffic

also does it make any difference if the virtual server is using the one connect profile or not?

Hi Pav,

 

 

If you are not getting anything logged it is because you are not getting any matching events.

 

 

This is probably why. The ".X" is not a valid Wildcard.

 

 

if {[HTTP::host] eq "78.42.24.X" or [HTTP::cookie exists "mxdata"] } {

 

 

 

You will either need to replace it with a valid wildcard for this situation or change the matching qualifier to a subnet value instead (78.42.24.0/24).

 

 

The OneConnect Profile should not matter. It only directs a deeper investigation of all incoming connections to see if they qualify for connection re-use or to better identify individual clients that may be NAT'ed behind a single IP Address.

 

 

Hope this helps.

I've changed it to a host name now

 

 

if {[HTTP::host] eq "test.search.co.uk" or [HTTP::cookie exists "searchdata"] } {

 

 

this irule is attached to a VS and i've been accessing the individual pool members and using the search function which calls to this external request which i'm trying to log the response times too i've even try usingt he following to log any traffic and im not getting anything either:

 

 

when CLIENT_ACCEPTED {

 

Get time for start of TCP connection in milleseconds

 

set tcp_start_time [clock clicks -milliseconds]

 

 

Log the start of a new TCP connection

 

log "New TCP connection from [IP::client_addr]:[TCP::client_port] to [IP::local_addr]:[TCP::local_port]"

 

}

 

when HTTP_REQUEST {

 

Get time for start of HTTP request

 

set http_request_time [clock clicks -milliseconds]

 

 

Log the start of a new HTTP request

 

set LogString "Client [IP::client_addr]:[TCP::client_port] -> [HTTP::host][HTTP::uri]"

 

log local0. "$LogString (request)"

 

}

 

 

when HTTP_RESPONSE {

 

Received the response headers from the server. Log the pool name, IP and port, status and time delta

 

log local0. "$LogString (response) - pool info: [LB::server] - status: [HTTP::status] (request/response delta: [expr [clock clicks -milliseconds] - $http_request_time]ms)"

 

}

 

when CLIENT_CLOSED {

 

Log the end time of the TCP connection

 

log "Closed TCP connection from [IP::client_addr]:[TCP::client_port] to [IP::local_addr]:[TCP::local_port] (open for: [expr [clock clicks -milliseconds] - $tcp_start_time]ms)"

 

}

This is strange that that Aarons rule to log tcp and http requests isnt working either as surely this shoudl log all requests made by this particular VS?

Hi All,

 

 

I have a ques regarding the IRULE for HTTP. We are running 9.4.7 version in our network and I have configure the syslog-ng file to log the logs for that particular Virtual Server into different file. But that file is not rotating on daily basis as LTM file. Can someone please help.

 

 

Regards,

 

 

Ganesh

I'm getting a parsing error when configuring syslog-ng:

 

 

b syslog include "

 

>

 

> local0.info send logger entries to remote syslog server

 

> filter f_local0.info {

 

> facility(local0) and level(info) and match("logger");

 

> };

 

>

 

> destination can be a hostname or IP address

 

> destination d_logger {

 

> udp("10.160.161.253" port (1026));

 

> };

 

>

 

> log {

 

> source(local);

 

> filter(f_local0.info);

 

> destination(d_logger);

 

> };"

 

BIGpipe parsing error:

 

012e0008:3: The requested command (filter f_local0.info {) is invalid

 

 

 

Did that and still having issues. Thanks for your help

 

 

b syslog include "

 

>

 

> local0info send logger entries to remote syslog server

 

> filter f_local0info {

 

> facility(local0) and level(info) and match("logger");

 

> };

 

>

 

> destination can be a hostname or IP address

 

> destination d_logger {

 

> udp("10.160.161.253" port (1026));

 

> };

 

>

 

> log {

 

> source(local);

 

> filter(f_local0info);

 

> destination(d_logger);

 

> };"

 

BIGpipe parsing error:

 

012e0008:3: The requested command (filter f_local0info {) is invalid

opers13

Try this:

include " 
filter f_local0.info { 
facility(local0) and level(info) and match("logger"); 
}; 
 
destination d_logger { 
udp(\"10.160.161.253\" port (1026)); 
}; 
 
log { 
source(local); 
filter(f_local0.info); 
destination(d_logger); 
};"
 

Note the escaping backslashes. See this article: https://devcentral.f5.com/tutorials/tech-tips/ltm-942-custom-syslog-configuration

Hope this helps,

N

Still getting parsing error:

 

 

b syslog include "

 

>

 

> filter f_local0.info {

 

> facility(local0) and level(info) and match("logger");

 

> };

 

>

 

> destination d_logger {

 

> udp(\"10.160.161.253\" port (1026));

 

> };

 

>

 

> log {

 

> source(local);

 

> filter(f_local0.info);

 

> destination(d_logger);

 

> };"

 

BIGpipe parsing error:

 

012e0008:3: The requested command (filter f_local0.info {) is invalid