Forum Discussion

Ajinkya's avatar
Ajinkya
Icon for Altostratus rankAltostratus
May 06, 2021
Solved

How to log more specific traffic in irule

Hi All,

 

I need help in logging the irule traffic.

I have i-rule, in which "switch" statement is used to redirect traffic to different pool.

there are 100+ URIs used under this statement for redirection as below;

 

 

switch -glob [ HTTP::uri ] {

 

"/abc/123/abc.html" {pool HTTP_POOL_1}

"/abd/124/abc.html" {pool HTTP_POOL_3}

"/abe/125/abc.html" {pool HTTP_POOL_6}

"/abf/126/abc.html" {pool HTTP_POOL_2}

"/abg/127/abc.html" {pool HTTP_POOL_4}

"/abh/128/abc.html" {pool HTTP_POOL_6}

"/abi/129/abc.html" {pool HTTP_POOL_7}

-

-

-

-

100+

}

 

my requirement is to log the traffic for only for "/abg/127/abc.html {pool HTTP_POOL_4}" with client IP. It should not log the traffic with other URIs.

 

Can anyone please help me with this?

 

  • Hi Ajinkya,

     

    I think the following should work:

     

    "/abg/127/abc.html" {

    pool HTTP_POOL_4

    log local0. "URI /abg/127/abc/html matched. Client IP [IP::client_addr]"

    }

     

    If you have a look here, there is a good explanation of the "switch" command, as well as some examples on what it can look like: https://clouddocs.f5.com/api/irules/switch.html

     

    Additionally, if you indeed have a 100+ entries in the switch statement, you may want to have a look at working with DataGroups, rather than the switch statement - it can improve performance quite a bit (if performance is a factor of course) You can find more info about this here: https://clouddocs.f5.com/api/irules/class.html

     

    Hope this helps.

3 Replies

  • Hi Ajinkya,

     

    I think the following should work:

     

    "/abg/127/abc.html" {

    pool HTTP_POOL_4

    log local0. "URI /abg/127/abc/html matched. Client IP [IP::client_addr]"

    }

     

    If you have a look here, there is a good explanation of the "switch" command, as well as some examples on what it can look like: https://clouddocs.f5.com/api/irules/switch.html

     

    Additionally, if you indeed have a 100+ entries in the switch statement, you may want to have a look at working with DataGroups, rather than the switch statement - it can improve performance quite a bit (if performance is a factor of course) You can find more info about this here: https://clouddocs.f5.com/api/irules/class.html

     

    Hope this helps.

  • Hi Alex,

    It is working!!!😃

     

    Thanks you so much for your help and also for sharing useful links!!

     

    • AlexBCT's avatar
      AlexBCT
      Icon for Cumulonimbus rankCumulonimbus

      Great to hear!

      Would be great if you can flag the above solution as an answer, so the thread can be closed and may help others with the same problem.