ABOUT DEVCENTRAL

DevCentral News Technical Forum Technical Articles Technical CrowdSRC Community Guidelines DevCentral EULA Get a Developer Lab License Become a DevCentral MVP

RESOURCES

Product Documentation White Papers Glossary Customer Stories Webinars Free Online Courses F5 Certification LearnF5 Training

SUPPORT

Manage Subscriptions Professional Services Professional Services Create a Service Request Software Downloads Support Portal

PARTNERS

Find a Reseller Partner Technology Alliances Become an F5 Partner Login to Partner Central

---

©2024 F5, Inc. All rights reserved.

Problem this snippet solves:

This iRule logs a line for the following events:

• when a new TCP connection is established with a client
• when the HTTP headers of an HTTP request are received from the client
• when the HTTP headers of an HTTP response are received from the pool member
• when the TCP connection with a client is closed

Code :

# Here is a sample of the log output for a single TCP connection with three HTTP requests:\n\n: New TCP connection from 192.168.99.210:2675 to 192.168.101.41:80\n\n:    Client 192.168.99.210:2675 -> test_http_vip/test0.html?parameter=val (request)\n:   Client 192.168.99.210:2675 -> test_http_vip/test0.html?parameter=val (response) - pool info http_pool 192.168.101.45 80  - status: 200 (request/response delta: 0ms)\n\n:    Client 192.168.99.210:2675 -> test_http_vip/test1.html?parameter=val (request)\n:   Client 192.168.99.210:2675 -> test_http_vip/test1.html?parameter=val (response) - pool info http_pool 192.168.101.45 80  - status: 200 (request/response delta: 0ms)\n\n:    Client 192.168.99.210:2675 -> test_http_vip/test2.html?parameter=val (request)\n:   Client 192.168.99.210:2675 -> test_http_vip/test2.html?parameter=val (response) - pool info http_pool 192.168.101.45 80  - status: 200 (request/response delta: 1ms)\n\n:   Closed TCP connection from 192.168.99.210:2675 to 192.168.101.41:80 (open for: 1078ms)\n\nwhen CLIENT_ACCEPTED {\n# Get time for start of TCP connection in milleseconds\nset tcp_start_time [clock clicks -milliseconds]\n\n# Log the start of a new TCP connection\nlog local0. \"New TCP connection from [IP::client_addr]:[TCP::client_port] to [IP::local_addr]:[TCP::local_port]\"\n}\nwhen HTTP_REQUEST {\n# Get time for start of HTTP request\nset http_request_time [clock clicks -milliseconds]\n\n# Log the start of a new HTTP request\nset LogString \"Client [IP::client_addr]:[TCP::client_port] -> [HTTP::host][HTTP::uri]\"\nlog local0. \"$LogString (request)\"\n}\n\nwhen LB_SELECTED {\nlog local0. \"Client [IP::client_addr]:[TCP::client_port]: Selected [LB::server]\"\n}\nwhen LB_FAILED {\nlog local0. \"Client [IP::client_addr]:[TCP::client_port]: Failed to [LB::server]\"\n}\nwhen SERVER_CONNECTED {\nlog local0. \"Client [IP::client_addr]:[TCP::client_port]: Connected to [IP::server_addr]:[TCP::server_port]\"\n}\nwhen HTTP_RESPONSE {\n# Received the response headers from the server.  Log the pool name, IP and port, status and time delta\nlog local0. \"$LogString (response) - pool info: [LB::server] - status: [HTTP::status] (request/response delta: [expr {[clock clicks -milliseconds] - $http_request_time}] ms)\"\n}\nwhen CLIENT_CLOSED {\n# Log the end time of the TCP connection\nlog local0. \"Closed TCP connection from [IP::client_addr]:[TCP::client_port] to [IP::local_addr]:[TCP::local_port] (open for: [expr {[clock clicks -milliseconds] - $tcp_start_time}] ms)\"\n}

Problem this snippet solves:

This iRule logs a line for the following events:

• when a new TCP connection is established with a client
• when the HTTP headers of an HTTP request are received from the client
• when the HTTP headers of an HTTP response are received from the pool member
• when the TCP connection with a client is closed

Code :

# Here is a sample of the log output for a single TCP connection with three HTTP requests:\n\n: New TCP connection from 192.168.99.210:2675 to 192.168.101.41:80\n\n:    Client 192.168.99.210:2675 -> test_http_vip/test0.html?parameter=val (request)\n:   Client 192.168.99.210:2675 -> test_http_vip/test0.html?parameter=val (response) - pool info http_pool 192.168.101.45 80  - status: 200 (request/response delta: 0ms)\n\n:    Client 192.168.99.210:2675 -> test_http_vip/test1.html?parameter=val (request)\n:   Client 192.168.99.210:2675 -> test_http_vip/test1.html?parameter=val (response) - pool info http_pool 192.168.101.45 80  - status: 200 (request/response delta: 0ms)\n\n:    Client 192.168.99.210:2675 -> test_http_vip/test2.html?parameter=val (request)\n:   Client 192.168.99.210:2675 -> test_http_vip/test2.html?parameter=val (response) - pool info http_pool 192.168.101.45 80  - status: 200 (request/response delta: 1ms)\n\n:   Closed TCP connection from 192.168.99.210:2675 to 192.168.101.41:80 (open for: 1078ms)\n\nwhen CLIENT_ACCEPTED {\n# Get time for start of TCP connection in milleseconds\nset tcp_start_time [clock clicks -milliseconds]\n\n# Log the start of a new TCP connection\nlog local0. \"New TCP connection from [IP::client_addr]:[TCP::client_port] to [IP::local_addr]:[TCP::local_port]\"\n}\nwhen HTTP_REQUEST {\n# Get time for start of HTTP request\nset http_request_time [clock clicks -milliseconds]\n\n# Log the start of a new HTTP request\nset LogString \"Client [IP::client_addr]:[TCP::client_port] -> [HTTP::host][HTTP::uri]\"\nlog local0. \"$LogString (request)\"\n}\n\nwhen LB_SELECTED {\nlog local0. \"Client [IP::client_addr]:[TCP::client_port]: Selected [LB::server]\"\n}\nwhen LB_FAILED {\nlog local0. \"Client [IP::client_addr]:[TCP::client_port]: Failed to [LB::server]\"\n}\nwhen SERVER_CONNECTED {\nlog local0. \"Client [IP::client_addr]:[TCP::client_port]: Connected to [IP::server_addr]:[TCP::server_port]\"\n}\nwhen HTTP_RESPONSE {\n# Received the response headers from the server.  Log the pool name, IP and port, status and time delta\nlog local0. \"$LogString (response) - pool info: [LB::server] - status: [HTTP::status] (request/response delta: [expr {[clock clicks -milliseconds] - $http_request_time}] ms)\"\n}\nwhen CLIENT_CLOSED {\n# Log the end time of the TCP connection\nlog local0. \"Closed TCP connection from [IP::client_addr]:[TCP::client_port] to [IP::local_addr]:[TCP::local_port] (open for: [expr {[clock clicks -milliseconds] - $tcp_start_time}] ms)\"\n}

We have a similar iRule with CLIENT_ACCEPTED, LB_SELECTED, SERVER_CONNECTED, and SERVER_CLOSED events. We perform SNAT in the LB_SELECTED event and logging in the SERVER_* events. When I try to apply this rule to a UDP VS, I get the following error:

01070394:3: TCP::client_port in rule (/Common/my_rule) requires an associated BIGPROTO or TCP or FASTHTTP profile on the virtual server (/Common/udp_vs).

 I understand the error and am wondering if the rule can be applied to a UDP VS. If not, how can I change the logging in SERVER_* events so as to resolve this error?

when SERVER_CONNECTED {\n    log local0. \"inner_ip=[IP::client_addr] inner_port=[TCP::client_port] outer_ip=[IP::local_addr] outer_port=[TCP::local_port] dest_ip=[IP::remote_addr] dest_port=[TCP::remote_port]\"\n}

 Additionally, would CLIENT_ACCEPTED and LB_SELECTED events work for UDP? I would really appreciate an pointers. Thank you.

Very usefull iRules. Thanks a lot.

https://devcentral.f5.com/s/articles/log-tcp-and-http-request-response-info