Christopher_J_B
Nov 09, 2010Nimbostratus
High # of transaction / TMM process not sending every log
I have several iRules - logging TCP connection specifics and then a few that parse XML and send to a syslog server to be parsed/indexed by Splunk.
Here is an example of the TCP iRule -
when CLIENT_ACCEPTED {
set tcp_start_time [clock clicks -milliseconds]
}
when CLIENT_CLOSED {
log -noname 10.66.48.45:514 local0.warning "DEVICE=SANPRODF5 ENV=PROD APP=CIDCSR COMMENT=TCP SRC=[IP::client_addr] SRCPORT=[TCP::client_port] DST=[IP::local_addr] DSTPORT=[TCP::local_port] OPEN=[expr [clock clicks -milliseconds] - $tcp_start_time]"
}
Recently been performing load tests (load runner) and the number of transactions from load runner don't jive with the syslog entries (about 30% off). I have been correlating other logs against iRule log entries and they are all off.
Using the iRule editor - I have been clearing/comparing the number of executions for "CLIENT_CLOSED" and that value compared to the syslog entires - those don't jive either.
Any else notice this issue?
Since an upgrade to v10 - I have been using HSL (high speed logging), but that doesn't seem to be helping either.