Remote looging : TCL error: /Common/irules_myirule <http_request> - Traffic rejected</http_request>

[Stéphane_PICARD]

Dear fellows, after spending a couple of hours trying to understand the reason for an error i get i come here to ask for your help...

In a very basic I-rule i'd like to remotely log (to a log consolidation server) when a given URI is requested :

Here is what i try :

when HTTP_REQUEST { if { ([class match [string tolower [HTTP::uri]] starts_with My_Uri] ) } { log 10.21.0.87 "TEST" (...)

and each time i receive a "TCL ERROR" as such :

TCL error: /Common/irules_myirule - Traffic rejected (line 1) (line 1) invoked from within "log 10.21.0.87 "TEST""

Any idea of what can happen ? What is "(line 1) (line 1)" related to ? FYI i tried different values like :

log 10.21.0.87:514 "TEST" log 10.21.0.87:514 local0.info "TEST" log 10.21.0.87:514 .info "TEST"

but each time this same TCL error, Traffic rejected.

On the other hand 10.21.3.34 is defined in the "Remote Syslog Server List" and i receive all the logs (which means to me that it is not a network/firewall issue between the F5 and this remote server.

Any clue will be more than welcome. With Regards

[JRahm]

Is 10.21.0.87 routable via TMM or is there a management route for that destination?

[Stéphane_PICARD]

Thanks Jason. Looking at the Configuration utility the Network/routes/Route list is empty. Does this answer your question ?

[Stanislas_Piro2]

Hi,

use HSL commands instead of log..

https://devcentral.f5.com/wiki/iRules.HSL.ashx

[Walter_Kacynski]

I've been struggling with this very recently as well. I'm logging the whole HTTP::request Is there a packet size limitation issue here since this is done over UDP?