Log Http Headers

Problem this snippet solves:

This simple rule logs all HTTP headers in requests and responses to /var/log/ltm. This can be helpful in troubleshooting.

Code :

when HTTP_REQUEST {
   set LogString "Client [IP::client_addr]:[TCP::client_port] -> [HTTP::host][HTTP::uri]"
   log local0. "============================================="
   log local0. "$LogString (request)"
   foreach aHeader [HTTP::header names] {
      log local0. "$aHeader: [HTTP::header value $aHeader]"
   }
   log local0. "============================================="
}
when HTTP_RESPONSE {
   log local0. "============================================="
   log local0. "$LogString (response) - status: [HTTP::status]"
   foreach aHeader [HTTP::header names] {
      log local0. "$aHeader: [HTTP::header value $aHeader]"
   }
   log local0. "============================================="   
}

# Sample output:

Rule log_http_headers_rule : =============================================
Rule log_http_headers_rule : Client 192.168.99.32:2950 -> webmail.example.com/exchange/Aaron/Inbox/?Cmd=contents (request)
Rule log_http_headers_rule : Host: webmail
Rule log_http_headers_rule : User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.9)
Rule log_http_headers_rule : Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,im
Rule log_http_headers_rule : Accept-Language: en-us,en;q=0.5
Rule log_http_headers_rule : Accept-Encoding: gzip,deflate
Rule log_http_headers_rule : Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Rule log_http_headers_rule : Keep-Alive: 300
Rule log_http_headers_rule : Connection: keep-alive
Rule log_http_headers_rule : Referer: https://webmail.example.com/exchange/
Rule log_http_headers_rule : X-Forwarded-For: 192.168.99.32
Rule log_http_headers_rule : Front-End-Https: On
Rule log_http_headers_rule : =============================================
Rule log_http_headers_rule : =============================================
Rule log_http_headers_rule : Client 192.168.99.32:2950 -> webmail.example.com/exchange/Aaron/Inbox/?Cmd=contents (response) - status: 200
Rule log_http_headers_rule : Date: Tue, 06 Nov 2007 16
Rule log_http_headers_rule : Server: Microsoft-IIS/6.0
Rule log_http_headers_rule : X-Powered-By: ASP.NET
Rule log_http_headers_rule : Content-Type: text/html
Rule log_http_headers_rule : Content-Length: 55446
Rule log_http_headers_rule : MS-WebStorage: 6.5.7638
Rule log_http_headers_rule : Cache-Control: no-cache
Rule log_http_headers_rule : =============================================
Published Mar 18, 2015
Version 1.0

9 Comments

No CommentsBe the first to comment