cancel
Showing results for 
Search instead for 
Did you mean: 
Login & Join the DevCentral Connects Group to watch the Recorded LiveStream (May 12) on Basic iControl Security - show notes included.

How to log more specific traffic in irule

Ajinkya
Altostratus
Altostratus

Hi All,

 

I need help in logging the irule traffic.

I have i-rule, in which "switch" statement is used to redirect traffic to different pool.

there are 100+ URIs used under this statement for redirection as below;

 

 

switch -glob [ HTTP::uri ] {

 

"/abc/123/abc.html" {pool HTTP_POOL_1}

"/abd/124/abc.html" {pool HTTP_POOL_3}

"/abe/125/abc.html" {pool HTTP_POOL_6}

"/abf/126/abc.html" {pool HTTP_POOL_2}

"/abg/127/abc.html" {pool HTTP_POOL_4}

"/abh/128/abc.html" {pool HTTP_POOL_6}

"/abi/129/abc.html" {pool HTTP_POOL_7}

-

-

-

-

100+

}

 

my requirement is to log the traffic for only for "/abg/127/abc.html {pool HTTP_POOL_4}" with client IP. It should not log the traffic with other URIs.

 

Can anyone please help me with this?

 

1 ACCEPTED SOLUTION

AlexBCT
MVP
MVP

Hi Ajinkya,

 

I think the following should work:

 

"/abg/127/abc.html" {

pool HTTP_POOL_4

log local0. "URI /abg/127/abc/html matched. Client IP [IP::client_addr]"

}

 

If you have a look here, there is a good explanation of the "switch" command, as well as some examples on what it can look like: https://clouddocs.f5.com/api/irules/switch.html

 

Additionally, if you indeed have a 100+ entries in the switch statement, you may want to have a look at working with DataGroups, rather than the switch statement - it can improve performance quite a bit (if performance is a factor of course) You can find more info about this here: https://clouddocs.f5.com/api/irules/class.html

 

Hope this helps.

View solution in original post

3 REPLIES 3

AlexBCT
MVP
MVP

Hi Ajinkya,

 

I think the following should work:

 

"/abg/127/abc.html" {

pool HTTP_POOL_4

log local0. "URI /abg/127/abc/html matched. Client IP [IP::client_addr]"

}

 

If you have a look here, there is a good explanation of the "switch" command, as well as some examples on what it can look like: https://clouddocs.f5.com/api/irules/switch.html

 

Additionally, if you indeed have a 100+ entries in the switch statement, you may want to have a look at working with DataGroups, rather than the switch statement - it can improve performance quite a bit (if performance is a factor of course) You can find more info about this here: https://clouddocs.f5.com/api/irules/class.html

 

Hope this helps.

Ajinkya
Altostratus
Altostratus

Hi Alex,

It is working!!!😃

 

Thanks you so much for your help and also for sharing useful links!!

 

Great to hear!

Would be great if you can flag the above solution as an answer, so the thread can be closed and may help others with the same problem.