Hi,
I think you are collecting even the verbs don't have body, such GET, HEAD, etc.
So, I edited that to consider only POST verb. If this is an webservice or something else, you should include another verbs to consider the collect.
This is what I would like to change:
when HTTP_REQUEST {
catch {HTTP::header remove "Accept-Encoding"}
set headers ""
set uri [HTTP::uri]
if { [HTTP::method] eq "POST" } {
if { [HTTP::header exists "Content-Length"] && [HTTP::header "Content-Length"] <= 2048 } {
set content_length [HTTP::header "Content-Length"]
} else {
set content_length 2048
}
if { $content_length > 0} {
HTTP::collect $content_length
}
}
log local0. "Client $ip | Request uri = [HTTP::method] $uri"
foreach head [HTTP::header names] {
append headers "$headers [HTTP::header values $head]"
}
if { [HTTP::header exists "X-Forwarded-For"] } {
set xff [getfield [lindex [HTTP::header values X-Forwarded-For] 0] "," 1]
}
set cookies [string map {" " ","} [lsort [HTTP::cookie names]]]
log local0. "Client $ip (XFF=$xff)| $headers"
}
when HTTP_REQUEST_DATA {
log local0. "Client $ip | Payload: [HTTP::payload]"
}
when HTTP_RESPONSE {
set resp_head ""
if { [HTTP::header exists "Content-Length"] && [HTTP::header "Content-Length"] <= 1048576 } {
set response_length [HTTP::header "Content-Length"]
} else {
set response_length 1048576
}
if { $response_length > 0 } {
HTTP::collect $response_length
}
log local0. "Client $ip | Request uri = $uri | Response status code = [HTTP::status] $response_length"
foreach head [HTTP::header names] {
append resp_head "$head=[HTTP::header values $head]"
}
log local0. "Response headers: $resp_head"
}
when HTTP_RESPONSE_DATA {
log local0. "Response payload: [HTTP::payload]"
}
Best regards.
Nimbostratus
