webalizer like reports from the LTM?

Question

I know I may be reaching here, but I wonder if there is a way to get webalizer (http://www.mrunix.net/webalizer/) like reports from the LTM?  We are using SNAT to connect to several weblogic servers, and even though I use the "insert x-forward-for" back to the servers, the weblogic logs seem to only capture the SNAT IP of the LTM.  And since weblogic is more of an application server vs. a web server, these logs may not give me all the info that apache or IIS will.&nbsp;
&nbsp;Anyone have any ideas?  Since the LTM is in the stream it would be nice to be able to generate data that could be viewed in a webalizer-like format.&nbsp;
&nbsp;Regards,
&nbsp;-L

joe_pruitt · Answer

I remember seeing an iRule around that logged messages to syslog in the format of a webserver log for just this purpose.  I'll have to see if I can dig it up.&nbsp;
&nbsp;-Joe

jrahm · Answer

This one, Joe?
when HTTP_REQUEST {
  set http_request_time [clock clicks -milliseconds]
  set request_log_line "Client IP: [IP::remote_addr]:[TCP::remote_port], \
        Vip IP: [IP::local_addr], \
        requesting: [HTTP::method]/[HTTP::host][HTTP::uri], \
        browser: [HTTP::header User-Agent], \
        Referer: [HTTP::header value Referer], \
        HTTP method: [HTTP::method], \
        HTTP version [HTTP::version], \
        JSESSION Cookie: [HTTP::cookie value JSESSIONID]"
}
when HTTP_RESPONSE {
  set http_response_time [ clock clicks -milliseconds ]
  log local0. "$request_log_line, \
        HTTP status: [HTTP::status], \
        Response Size: [HTTP::payload length], \
        Duration: [expr $http_response_time - $http_request_time], \
        Server IP: [LB::server addr]"
}

leslie_south_55 · Answer

I have a version of this working how I want it now, using a snip from another rule found here.  Question is, if I am logging the HTTP_RESPONSE, will I get log info for data that is served from RAMCACHE on the LTM?&nbsp;
&nbsp;-L

leslie_south_55 · Answer

here is the rule I am using&nbsp;when HTTP_REQUEST { 
&nbsp;set curtime [clock seconds]
&nbsp;set formattedtime [clock format $curtime -format {%d/%b/%Y:%T %z}]
&nbsp;set log_format "[IP::client_addr] - - $$$formattedtime$$ \"[HTTP::method] [HTTP::uri] HTTP/[HTTP::version]\""
&nbsp;}
&nbsp;when HTTP_RESPONSE {
&nbsp;log local0.info "$log_format [HTTP::status]"
&nbsp;} &nbsp;

sre_81614 · Answer

Hey lsouth! 
&nbsp;  
&nbsp; I have the same problem and some question regarding it. 
&nbsp;  
&nbsp; - Is this rule still working out for you or do you already have a better approach? 
&nbsp; - Are you using a remote syslog where you log to? 
&nbsp; - Do you also get log lines from objects hitting the RAM cache?  
&nbsp;  
&nbsp; Greets, 
&nbsp;  
&nbsp; Sascha

Forum Discussion

webalizer like reports from the LTM?

6 Replies

Recent Discussions

Open Redirection Mitigation

F5Access | MacOS Sonoma

enable tls1.2 on management interface on F5 ltm running version 10.x

[ASM] - what is "Browser Challenge file" ?

SMS server with BIGIP

Related Content

Re: BigIP Report

BigIP Report Old

Get started with F5 Distributed Cloud WAAP Scheduled Reports

F5 2023 State of Application Strategy Report

SSL Certificate Report