Log Http Headers
Problem this snippet solves:
This simple rule logs all HTTP headers in requests and responses to /var/log/ltm. This can be helpful in troubleshooting.
Code :
when HTTP_REQUEST { set LogString "Client [IP::client_addr]:[TCP::client_port] -> [HTTP::host][HTTP::uri]" log local0. "=============================================" log local0. "$LogString (request)" foreach aHeader [HTTP::header names] { log local0. "$aHeader: [HTTP::header value $aHeader]" } log local0. "=============================================" } when HTTP_RESPONSE { log local0. "=============================================" log local0. "$LogString (response) - status: [HTTP::status]" foreach aHeader [HTTP::header names] { log local0. "$aHeader: [HTTP::header value $aHeader]" } log local0. "=============================================" } # Sample output: Rule log_http_headers_rule: ============================================= Rule log_http_headers_rule : Client 192.168.99.32:2950 -> webmail.example.com/exchange/Aaron/Inbox/?Cmd=contents (request) Rule log_http_headers_rule : Host: webmail Rule log_http_headers_rule : User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.9) Rule log_http_headers_rule : Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,im Rule log_http_headers_rule : Accept-Language: en-us,en;q=0.5 Rule log_http_headers_rule : Accept-Encoding: gzip,deflate Rule log_http_headers_rule : Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7 Rule log_http_headers_rule : Keep-Alive: 300 Rule log_http_headers_rule : Connection: keep-alive Rule log_http_headers_rule : Referer: https://webmail.example.com/exchange/ Rule log_http_headers_rule : X-Forwarded-For: 192.168.99.32 Rule log_http_headers_rule : Front-End-Https: On Rule log_http_headers_rule : ============================================= Rule log_http_headers_rule : ============================================= Rule log_http_headers_rule : Client 192.168.99.32:2950 -> webmail.example.com/exchange/Aaron/Inbox/?Cmd=contents (response) - status: 200 Rule log_http_headers_rule : Date: Tue, 06 Nov 2007 16 Rule log_http_headers_rule : Server: Microsoft-IIS/6.0 Rule log_http_headers_rule : X-Powered-By: ASP.NET Rule log_http_headers_rule : Content-Type: text/html Rule log_http_headers_rule : Content-Length: 55446 Rule log_http_headers_rule : MS-WebStorage: 6.5.7638 Rule log_http_headers_rule : Cache-Control: no-cache Rule log_http_headers_rule : =============================================
Published Mar 18, 2015
Version 1.0hooleylist
Cirrostratus
Joined September 08, 2005
hooleylist
Cirrostratus
Joined September 08, 2005
- jeromeNNimbostratus
how to have a simple unique line
@Saravana,
 
You can add the sendmail part in the irule and email it.
 
https://clouddocs.f5.com/api/irules/Send-Email-via-iRule-Procedures.html
 
- bsbNimbostratus
Excellant, we have this irule handy and bind whenever there is a troubleshooting required. i normally capture tcpdump everytime, this helped me a lot. is there an option to forward it to an email once it logs.
- arunalukka_1616Nimbostratus
Great article.Thanks
- philyeo_72087NimbostratusJust a quick warning. In the case where there are multiple headers with the same name, it will only show the last one. I think you can use: log local0. "$aHeader: [HTTP::header values $aHeader]" to get the full list
- Ernesto_Mayol_2NimbostratusIs there a way to overcome the 1024 byte limitation on log size. I am testing an application that utilizes huge http headers and those are being truncated in the log which hinders troubleshooting. I am looking for a way to get this logs locally somehow without the need to setup a remote Syslog server and use HSL, that would take considerable time and expertise that I do not have unfortunately.
- F5Hopper_28651Nimbostratushow can I tweak this irule to a Virtual Server for port 3389(RDP) also, 1433(SQL).. I found two VirtualServers running and I dont know who is connecting to them.
- Chew_Bacca_1523Nimbostratusnevermind. It works. I was just looking at the wrong box (standby). Thanks
- Chew_Bacca_1523NimbostratusGreat article. I applied the irule to my VS but I dont see the any HTTP_RESPONSE in the /var/log/ltm Do I need to enable debug in any particular log for this to work?