Forum Discussion
Stanislas_Piro2
Feb 12, 2019Cumulonimbus
Use this code
when ACCESS_SESSION_STARTED {
ACCESS::session data set session.custom [HTTP::header X-Forwarded-For]
}
when ACCESS_POLICY_COMPLETED {
log local0. "SESSION_STARTED, User=[ACCESS::session data get session.logon.last.username], IP=[ACCESS::session data get session.custom.xff]"
}