Apache Style Logging with HSL
Problem this snippet solves:
When SNATing to servers, the client IP is lost. This was information our security group and developers wanted to have available, so I created an iRule to use the HSL functionality in BigIP 10 to do that. Without cracking open the HTTP stream, I was unable to get the REMOTE_USER CGI variable, so I used that field to log the HTTP::host instead (since that information is lost with several VIPs logging to the same location).Code :
# Apache: ClientIP - Username 10/Oct/2000
# iRule: ClientIP - Host 10/Oct/2000
when CLIENT_ACCEPTED {
set hsl [HSL::open -proto UDP -pool syslog.example.com_syslog_pool]
set clientip [IP::remote_addr]
}
when HTTP_REQUEST {
set method [HTTP::method]
set uri [HTTP::uri]
set host [HTTP::host]
}
when HTTP_RESPONSE {
set now [clock format [clock seconds] -format "%d/%b/%Y:%H:%M:%S %z"]
set contentlength [HTTP::header "Content-Length"]
# Log HTTP request via syslog protocol as local7.info; see RFC 3164 for more info
# local7 = 23; info = 6; 8*23 + 6 = 190
HSL::send $hsl "<190> $clientip $host - $now \"$method $uri HTTP/[HTTP::version]\" [HTTP::status] $contentlength\n"
#log local0. "<190> $clientip $host - $now \"$method $uri HTTP/[HTTP::version]\" [HTTP::status] $contentlength"
}Tested this on version:
10.2Published Jan 30, 2015
Version 1.0
