iRule for URL content filter and redirect

You're using a glob operator on the switch command, so you should use some form of wildcard to indicate where this string may exist in the URI. A URI will always start with a forward slash "/", so if you knew the URI started with this string, you could do this:

"/administrator*"    

Otherwise your iRule should look like this:

when HTTP_REQUEST { 
    log local0. "uri is [HTTP::uri]" 
    switch -glob -- [string tolower [HTTP::uri]] {
        "*administrator*" {
            HTTP::respond 200 content { We are sorry, but the URL you requested is ILLEGAL. For other information, please contact IT Administrator @ XXXX }
            log local0. "Request from [IP::client_addr] for [HTTP::uri] has been rejected." 
        }
    }        
}

But your code is like mine. I just copied/pasted your code. Result the same. i.e It Blocks the page containing administrator but still the log doesn't appear in reporting section.

you may didn't understand my question because of reply format issue.

Code

Ah, I see. Yes I misunderstood your question. The log local0. command is going to send log messages to /var/log/ltm by default. If you want to send it to another facility, see this document:

http://support.f5.com/kb/en-us/solutions/public/13000/300/sol13317.html?sr=32853626

I'm not quite sure what you mean by "reporting section". Where is it that you need to see these messages?

Sorry to interfer, just wanted to follow-up a question based on your conversation. I have almost same requirement.

My question is this: What if I wanted to check both "upload" and "images" on the same request, and if match you go to pool SERVER1? what will be the iRule format?

when HTTP_REQUEST { switch -glob [HTTP::host][HTTP::uri] { "/upload" - " images " { pool SERVER1 } } }

thanks!

It'd be more like this:

when HTTP_REQUEST {
    if { ( [string tolower [HTTP::uri]] contains "upload" ) and ( [string tolower [HTTP::uri]] contains "images" ) } {
        pool SERVER1
    } else {
        pool SOME_OTHER_POOL
    }
}

Thanks Kevin, any chance that we can use the "switch command", the strings that i need to match are about a hundred :)

I’m wondering if there’s a change in the “ – “ syntax to check match both strings, as this works as an OR, what can we use to make it AND statement?

A switch is comparable to an "if/else if". There's no "and" context between the evaluations.