# iRule to log traffic details **URL:** \ **Category:** Technical Forums\ **Tags:** devops, security, application-delivery\ **Created:** [September 21, 2023, 9:44pm UTC](https://community.f5.com/t/irule-to-log-traffic-details/73134 "2023-09-21T21:44:38Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![yadgayan](https://d1p9zq3aats0t8.cloudfront.net/user_avatar/community.f5.com/yadgayan/32/7091_2.png) [@yadgayan](https://community.f5.com/u/yadgayan)\ **Post date:** [September 21, 2023, 9:44pm UTC](https://community.f5.com/t/irule-to-log-traffic-details/73134/1 "2023-09-21T21:44:38Z")
Hi, I want to log below information to syslog via iRule Request headers including e.g. tap-\*, X-\* (e.g. X-Forwarded-For & X-Forwarded-Port ) src IP src Port request url referral url method response sessionid x\_uri (assume included from F5) timestamp (ms granular) Any one has iRule handy for this or covers partially? Thank you, ---
**Author:** ![Mohamed\_Ahmed\_Kansoh](https://d1p9zq3aats0t8.cloudfront.net/user_avatar/community.f5.com/mohamed_ahmed_kansoh/32/10886_2.png) [@Mohamed\_Ahmed\_Kansoh](https://community.f5.com/u/Mohamed_Ahmed_Kansoh)\ **Post date:** [September 21, 2023, 10:34pm UTC](https://community.f5.com/t/irule-to-log-traffic-details/73134/2 "2023-09-21T22:34:19Z")
Hi  @yadgayan  , U can use this : ```tcl when HTTP_REQUEST { log local0. "HTTP Method = [HTTP::method]" log local0. "HTTP URI = [HTTP::uri]" log local0. "HTTP Path = [HTTP::path]" log local0. "HTTP Query = [HTTP::query]" log local0. "HTTP Version = [HTTP::version]" log local0. "HTTP Host Header = [HTTP::host]" log local0. "HTTP User Agent Header = [HTTP::header value "user-agent"]" } when HTTP_RESPONSE { log local0. "HTTP Status = [HTTP::status]" log local0. "HTTP version = [HTTP::version]" log local0. "HTTP Content Length Header = [HTTP::header value "content-length"]" } ``` - you can remove any info you don’t want to log it.  refer to this Link to find our more : [https://my.f5.com/manage/s/article/K42210592](https://my.f5.com/manage/s/article/K42210592) I haven’t tested this irule , but it should work. By the way : you can use High speed logging ( HSL ), it’s pretty good to use :  > **[myF5](https://my.f5.com/manage/s/article/K00847516)** I hope this helps u 🙂 ---
**Author:** ![yadgayan](https://d1p9zq3aats0t8.cloudfront.net/user_avatar/community.f5.com/yadgayan/32/7091_2.png) [@yadgayan](https://community.f5.com/u/yadgayan)\ **Post date:** [September 21, 2023, 11:12pm UTC](https://community.f5.com/t/irule-to-log-traffic-details/73134/3 "2023-09-21T23:12:38Z")
i added all into single. when HTTP\_REQUEST { log local0. “HTTP Method = [HTTP::method] Client = [IP::client\_addr] HTTP URI = [HTTP::uri] HTTP Path = [HTTP::path] HTTP Query = [HTTP::query] HTTP Version = [HTTP::version] HTTP Host Header = [HTTP::host] HTTP User Agent Header = [HTTP::header value “user-agent”] Session\_ID=[ACCESS::session data get session.user.sessionid] Assigned PPP Dynamic IPv4: [ACCESS::session data get session.assigned.clientip] NA Resource: [ACCESS::session data get session.assigned.resources.na] Client IP: [ACCESS::session data get session.user.clientip]” } when HTTP\_RESPONSE { log local0. “HTTP Status = [HTTP::status] HTTP version = [HTTP::version] HTTP Content Length Header = [HTTP::header value “content-length”]” } will this cover all? ---
**Author:** ![Mohamed\_Ahmed\_Kansoh](https://d1p9zq3aats0t8.cloudfront.net/user_avatar/community.f5.com/mohamed_ahmed_kansoh/32/10886_2.png) [@Mohamed\_Ahmed\_Kansoh](https://community.f5.com/u/Mohamed_Ahmed_Kansoh)\ **Post date:** [September 21, 2023, 11:18pm UTC](https://community.f5.com/t/irule-to-log-traffic-details/73134/4 "2023-09-21T23:18:42Z")
@yadgayan  ,  yes all in same irule , this will be good. but monitor your system resources utilization ( CPU , Memory ) Go to Statistics \>\>\> Performance report \>\>\>\> then have a look in CPU & memory graphs and curves after adding this irule. it’s recommended to monitor that because irules consumes cpu cycles . ---
**Author:** ![yadgayan](https://d1p9zq3aats0t8.cloudfront.net/user_avatar/community.f5.com/yadgayan/32/7091_2.png) [@yadgayan](https://community.f5.com/u/yadgayan)\ **Post date:** [September 22, 2023, 12:53am UTC](https://community.f5.com/t/irule-to-log-traffic-details/73134/5 "2023-09-22T00:53:52Z")
its working but how i log meta of a session (e.g. cookie, transaction)? ---
**Author:** ![Mohamed\_Ahmed\_Kansoh](https://d1p9zq3aats0t8.cloudfront.net/user_avatar/community.f5.com/mohamed_ahmed_kansoh/32/10886_2.png) [@Mohamed\_Ahmed\_Kansoh](https://community.f5.com/u/Mohamed_Ahmed_Kansoh)\ **Post date:** [September 22, 2023, 1:13am UTC](https://community.f5.com/t/irule-to-log-traffic-details/73134/6 "2023-09-22T01:13:06Z")
@yadgayan  , you can log cookie info by this way in the following article : [https://community.f5.com/t5/technical-forum/log-the-http-cookie-name-value-and-path-using-irule/td-p/112783](https://community.f5.com/topic/112783) I don’t understand what do you mean by transaction ? Transaction means \>\>\>\> HTTP request and u already log ( methods , headers , cookies , ips , … )  so what is the transaction do you want to log ? ---
**Author:** ![LiefZimmerman](https://d1p9zq3aats0t8.cloudfront.net/user_avatar/community.f5.com/liefzimmerman/32/3355_2.png) [@LiefZimmerman](https://community.f5.com/u/LiefZimmerman)\ **Post date:** [September 26, 2023, 4:45am UTC](https://community.f5.com/t/irule-to-log-traffic-details/73134/7 "2023-09-26T04:45:47Z")
@yadgayan   - If your post was solved it would be helpful to the community to select **Accept As Solution**. Thanks for joining and being part of our community. ---
**Author:** ![yadgayan](https://d1p9zq3aats0t8.cloudfront.net/user_avatar/community.f5.com/yadgayan/32/7091_2.png) [@yadgayan](https://community.f5.com/u/yadgayan)\ **Post date:** [September 26, 2023, 6:42am UTC](https://community.f5.com/t/irule-to-log-traffic-details/73134/8 "2023-09-26T06:42:05Z")
Thanks  @Mohamed_Ahmed_Kansoh I modified and made a single log entry to achieve my goal. But thanks a lot for the direction. ---
**Author:** ![LiefZimmerman](https://d1p9zq3aats0t8.cloudfront.net/user_avatar/community.f5.com/liefzimmerman/32/3355_2.png) [@LiefZimmerman](https://community.f5.com/u/LiefZimmerman)\ **Post date:** [September 26, 2023, 3:37pm UTC](https://community.f5.com/t/irule-to-log-traffic-details/73134/9 "2023-09-26T15:37:30Z")
Since there was a bit of modification on the original suggestion I’ve also accepted your clarification as part of the solution. Thanks for following up.