I had to retype it from scratch to get it to behave and only alert on the DataGroup Names.
when HTTP_RESPONSE {
if { [HTTP::cookie count] > 0 } {
set maxCookieSize [class match -value "CookieMaxSize" equals COOKIE_INFO_LIST]
foreach cookie_name [HTTP::cookie names] {
if { ![class match $cookie_name equals MASTER_COOKIE_JAR_LIST] } {
log local0. "INVALID SET-COOKIE DETECTED - Cookie: $cookie_name"
}
set cookieSize [string length [HTTP::cookie $cookie_name]]
if { $cookieSize > $maxCookieSize } {
log local0. "INVALID SET-COOKIE Size - $cookieSize for Cookie:$cookie_name"
}
}
}
}
Cirrus
Nimbostratus