For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

martyn's avatar
martyn
Icon for Altostratus rankAltostratus
Oct 08, 2020
Solved

iRule HSL logging question with user specified text

I wish to log via HSL a mesage that contains some repeatable text as well as some user generated text. so one of two ways to get text generated I can see. But I some issues with each method. #1: Use ...
application delivery
iRules
LTM
security
  • Dario_Garrido's avatar
    Dario_Garrido
    Oct 20, 2020

    Hello Martin.

    With a request-logging profile you can set any kind of format in the template field.

    An example of CEF format:

    CEF:0|F5|MyEnv|1|sip=$CLIENT_IP sprt=$CLIENT_PORT snatip=$SNAT_IP snatprt=$SNAT_PORT dstip=$SERVER_IP dstprt=$SERVER_PORT dhost=$BIGIP_HOSTNAME apm=$X_APM

    Where 'X_APM can be configured injecting an HTTP header:

    when HTTP_REQUEST {
	HTTP::header replace X_APM [ACCESS::session data get session.custom.name]
}
when HTTP_REQUEST_RELEASE {
	HTTP::header remove X_APM
}

    ---

    In case you still want to use an iRule, you can get those parameters with:

    1) Hostname

    $static::tcl_platform(machine)

    2) Time

    set curtime [clock seconds]
set formattedtime [clock format $curtime]
log "$curtime seconds since epoch, $formattedtime"

    Output: 1129552706 seconds since epoch, Mon Oct 17 07:38:26 CDT 2005

    Regards,

    Dario.

martyn's avatar
martyn
Icon for Altostratus rankAltostratus
Oct 19, 2020
Thanks, Not sure that would work in this case. What I need to simulate is the CEF logging format and that is not available from a native profile format choice, plus the data I need to pass in (some arbitrary data). If in effect I am manually writing the CEF formatted message out by a number of profile objects/variables and as well a HTTP header variable(s) or two as data place holders I pretty much may as well just manually create the whole thing via HSL as I am currently. However some (most) of the data that I want is matched from data available in a logging profile, This I am currently getting it from TCL calls, Should they have too great a performance hit I may well see if your proposal would alleviate that. I also didn't know of (think of) using HTTP_REQUEST like that. Interesting and devious I will file that one away, thank you. Martyn Roberts Vodafone/IBM Venture Swindon ISC 07881846887
martyn's avatar
martyn
Icon for Altostratus rankAltostratus
Oct 20, 2020
Dario, No probs. Of course I will. The answer was reasonable, considered and properly related to the question. It also included some very interesting and useful information. As I said I like the HTTP injection. Martyn Roberts Vodafone/IBM Venture Swindon ISC 07881846887