Logging HTTP response header to /var/log/ltm and Splunk

[ant77]

Hello everyone -

I tried to log an HTTP response to the local log and since the syslog and analytics are being sent to spunk from the BigIP, it does not seem to be working.

Using this iRule and adding it to a virtual server, I don't see anything in the logs....Am I missing something? Thanks for your help!

when HTTP_RESPONSE {
    log local0. "HTTP Status = [HTTP::status]"
    log local0. "HTTP version = [HTTP::version]"
    log local0. "HTTP Content Length Header = [HTTP::header value "content-length"]"
}

[JRahm]

these should log as expected to /var/log/ltm. try reapplying the irule or checking other irules log info.

[eey0re]

Maybe there is some custom log config? What is the output of TMSH command: list /sys syslog

(Redact IPs if you need to.)

[Nikoolayy1]

Can you test without log local0. "HTTP Content Length Header = [HTTP::header value "content-length"]" just to see if it is ok. Also check for TCL error messages in the /var/log/ltm just in case and confirm that the VIP counters are going up, so that traffic i reaching the f5 device.