I need to log http request and response for a VIP using iRule. Was trying to follow below URL but i have some questions.
https://support.f5.com/csp/article/K42210592
1st what I should Put in the excel field. ? And here it does not say to match VIP IP , so how it will know how to match which VIP or whatever VIP I call this iRule will be applied to that VIP Only ?>
when HTTP_REQUEST {
if {[IP::addr [IP::client_addr]] equals "10.10.10.10"} {
First you need to provision this iRule in the resources section of one specific virtual server.
After that, this iRule will be executed when the specific condition occurs, in your example (HTTP_REQUEST), when one HTTP resquest is received.
Beside this, take into account that "<action>" will only be executed when source IP ([IP::client_addr]) matches "10.10.10.10". You can modify it appropriately.
In your "action" section you can log anything (variables, text, etc.). An example:
when HTTP_REQUEST {
if {[IP::addr [IP::client_addr]] equals "10.10.10.10"} {
log local0. "Traffic matches the iRule"
}
}
Another example:
when HTTP_REQUEST {
if {[IP::addr [IP::client_addr]] equals "10.10.10.10"} {
log local0. "Traffic matches the iRule with source IP: [IP::client_addr]"
}
}
For logging traffic with responses, you should use HTTP_RESPONSE event.
iRule_http exampleiRuleirule_httpDescriptionThis rule collects and sends http(s) traffic data and lb_faild event data to the Splunk platform. A load balancing failure triggers this event.Example
when CLIENT_ACCEPTED {
set client_address [IP::client_addr]
set vip [IP::local_addr]
}
when HTTP_REQUEST {
set http_host [HTTP::host]:[TCP::local_port]
set http_uri [HTTP::uri]
set http_url $http_host$http_uri
set http_method [HTTP::method]
set http_version [HTTP::version]
set http_user_agent [HTTP::header "User-Agent"]
set http_content_type [HTTP::header "Content-Type"]
set http_referrer [HTTP::header "Referer"]
set tcp_start_time [clock clicks -milliseconds]
set req_start_time [clock format [clock seconds] -format "%Y/%m/%d %H:%M:%S"]
set cookie [HTTP::cookie names]
set user [HTTP::username]
set virtual_server [LB::server]
if { [HTTP::header Content-Length] > 0 } then {
set req_length [HTTP::header "Content-Length"]
} else {
set req_length 0
}
}
when HTTP_RESPONSE {
set res_start_time [clock format [clock seconds] -format "%Y/%m/%d %H:%M:%S"]
set node [IP::server_addr]
set node_port [TCP::server_port]
set http_status [HTTP::status]
set req_elapsed_time [expr {[clock clicks -milliseconds] - $tcp_start_time}]
For HTTP VIP better use the integraded F5 Request Logging profile if possible as the previous solutions that were provided to you need an iRule. Check if you can use Request Logging profile or the iRules that @ Sajid or @Dario Garrido provided.
13-Jun-202122:45 - last edited on 24-Mar-202202:13 by li-migration
You create the irule as per the article that you've shared. Then you have to bind (apply) that Irule to your VS. So only that VIP will process that Irule & you'll get your loggings.
