Forum Discussion
Hi @Niels van Sluis thanks for your Replay. this irule is working but works for Header and it looks like i made a mistake and the SOAPActino is located at the message body and not at the header as i though . mean i need to look at the body. this is already made by payload ?
- Nov 20, 2016
Take a look at this code snippet. This will probably help you.
 
- YossiVNov 21, 2016Nimbostratus
hi Niels i will try this and will update 10x
- YossiVNov 22, 2016Nimbostratus
ok so i manged this to work (SOAPAction is now passing on the Header) so now this catch the SOAPAction from the header. but now my Quashtion now is how to log spesific events and not all SOAPAction messages. i was trying the switch -glob but than no logs came at all.
when RULE_INIT {set static::bigip [info hostname] set static::facility <191> set static::hsl_prefix "$static::facility|host=$static::bigip" } when CLIENT_ACCEPTED { set hsl [HSL::open -proto UDP -pool pool-tng-graylog-HSL] set tcp_start_time [clock clicks -milliseconds] } when HTTP_REQUEST { set http_request_time [clock clicks -milliseconds] set SOAPAction [HTTP::header "SOAPAction"] set hsl_prefix0 $SOAPAction } when HTTP_REQUEST_SEND { set http_request_send_time [clock clicks -milliseconds] } when LB_SELECTED { set lb_selected_time [clock clicks -milliseconds] set hsl_prefix "${static::hsl_prefix}|Winweb=[LB::server addr]|F5_ClientIP=[client_addr]" } when SERVER_CONNECTED { set connection_time [expr {[clock clicks -milliseconds] - $lb_selected_time}] } when HTTP_RESPONSE { set upstream_time [expr {[clock clicks -milliseconds] - $http_request_send_time}] } when HTTP_RESPONSE_RELEASE { HSL::send $hsl "$hsl_prefix|event=X_REQUEST|total_time=[expr {[clock clicks -milliseconds] - $http_request_time}]|upstream_time=$upstream_time|connection_time=$connection_time|vserver_name= [virtual name]\n|SOAPAction=$hsl_prefix0" }
- Nov 22, 2016
I think the iRule I made earlier should work, but I see I've made a little typo in there. I forgot to close the withdrawal and depost with a " character. So change:
"*deposit* - "*withdrawal* {
to:
"*deposit*" - "*withdrawal*" {
And try again. Check /var/log/ltm to see if the iRule isn't complaining about errors.