Technical Forum
Ask questions. Discover Answers.
cancel
Showing results for 
Search instead for 
Did you mean: 

Logging HTTP response header to /var/log/ltm and Splunk

ant77
Cirrus
Cirrus

Hello everyone -

I tried to log an HTTP response to the local log and since the syslog and analytics are being sent to spunk from the BigIP, it does not seem to be working.

Using this iRule and adding it to a virtual server, I don't see anything in the logs....Am I missing something? Thanks for your help!

when HTTP_RESPONSE {
    log local0. "HTTP Status = [HTTP::status]"
    log local0. "HTTP version = [HTTP::version]"
    log local0. "HTTP Content Length Header = [HTTP::header value "content-length"]"
}
3 REPLIES 3

JRahm
Community Manager
Community Manager

these should log as expected to /var/log/ltm. try reapplying the irule or checking other irules log info.

eey0re
Cirrostratus
Cirrostratus

Maybe there is some custom log config? What is the output of TMSH command: list /sys syslog

 

(Redact IPs if you need to.)

Can you test without log local0. "HTTP Content Length Header = [HTTP::header value "content-length"]" just to see if it is ok. Also check for TCL error messages in the /var/log/ltm just in case and confirm that the VIP counters are going up, so that traffic i reaching the f5 device.