BIG-IP : irule not matching uri as expected

Forums Technical Forums
, , , , ,
1

F5 BIG-IP Virtual Edition v11.4.1 (Build 635.0) LTM on ESXi

This code is logging all requests - including those with uri “/404” :

when HTTP_REQUEST {
  if {[HTTP::uri] != "/404"} {
    log local0. "uri = [HTTP::uri]"
  }
}

Where is my mistake ?

2

Are you trying to log the 404 error in the response packet? try using when HTTP_RESPONSE function and see if you can log 404 error.

3

does the logged /404 uri match exactly /404 as per your irule or does it start with or contain /404 i.e. /404/

cheers

4

/404 is a uri not a response error

5

You can try using HTTP::path instead of HTTP::uri when HTTP_REQUEST { if {[HTTP::path] != “/404”} { log local0. “uri = [HTTP::uri]” } }

6

not sure what’s going on then - I’m using 11.6 VE, prehaps you can run the same commands and post your results

ltm rule test404 {
  when HTTP_REQUEST {
    if {[HTTP::uri] != "/404"} {
      log local0. "uri = [HTTP::uri]"
    }
  }
}

[root@f5lab] config  curl http://10.12.12.145/402
[root@f5lab] config  curl http://10.12.12.145/403
[root@f5lab] config  curl http://10.12.12.145/404
[root@f5lab] config  curl http://10.12.12.145/405

Sep 18 16:43:00 f5lab info tmm[17994]: Rule /Common/test404 : uri = /402
Sep 18 16:43:05 f5lab info tmm[17994]: Rule /Common/test404 : uri = /403
Sep 18 16:43:11 f5lab info tmm[17994]: Rule /Common/test404 : uri = /405
7

I tried with both HTTP::path and HTTP::uri - It works fine. i am using v11.4.1 BIG-IP appliance.

8

/404 is the entire uri ( no query-params ) so aren’t [HTTP::path] and [HTTP::uri] equivalent ?

9

Agree, Yes that is correct you could use either. log the full uri when the request comes in before it goes to the if statement. To verify it is exactly what you expect it to be and then work out why it doesnt not match the expression for /404 ?

10

Try using ne instead of !=. You may be having an issue with data type conversion. Using ne will ensure you are doing a string comparison. I’m not positive that is the issue, but it’s an easy change to test.