Trying to create audit logs with session variable from APM

Aaron,

I did actually log a case with F5 and they gave me some hints to fix my rule. The problem was with the order I trying to collect the data and the order that the events trigger.

The updated rule (which does what I need so far) is:

when CLIENT_ACCEPTED {
  set userip [IP::client_addr]
  set username "unknown"
  set sessionid "unknown"
}

when ACCESS_ACL_ALLOWED {
  set username [ACCESS::session data get "session.logon.last.username"]
  set sessionid [ACCESS::session data get "session.user.sessionid"]
  log local7. "$userip $username $sessionid [HTTP::uri]"
}