Forum Discussion

jondyke_46152's avatar
jondyke_46152
Icon for Nimbostratus rankNimbostratus
Nov 05, 2008

Logging based in IP

There is a very useful irule in the codeshare section for logging tcp and http response information.

 

 

when CLIENT_ACCEPTED {

 

Get time for start of TCP connection in milleseconds

 

set tcp_start_time [clock clicks -milliseconds]

 

 

Log the start of a new TCP connection

 

log "New TCP connection from [IP::client_addr]:[TCP::client_port] to [IP::local_addr]:[TCP::local_port]"

 

}

 

when HTTP_REQUEST {

 

Get time for start of HTTP request

 

set http_request_time [clock clicks -milliseconds]

 

 

Log the start of a new HTTP request

 

set LogString "Client [IP::client_addr]:[TCP::client_port] -> [HTTP::host][HTTP::uri]"

 

log local0. "$LogString (request)"

 

}

 

 

when HTTP_RESPONSE {

 

Received the response headers from the server. Log the pool name, IP and port, status and time delta

 

log local0. "$LogString (response) - pool info: [LB::server] - status: [HTTP::status] (request/response delta: [expr [clock clicks -milliseconds] - $http_request_time]ms)"

 

}

 

when CLIENT_CLOSED {

 

Log the end time of the TCP connection

 

log "Closed TCP connection from [IP::client_addr]:[TCP::client_port] to [IP::local_addr]:[TCP::local_port] (open for: [expr [clock clicks -milliseconds] - $tcp_start_time]ms)"

 

}

 

 

 

 

However you would get a lot of logging on a production site if you applied this rule on all client IP addresses. I was wondering how I could incorporate a filter on IP address so that it only logs from a praticluar client IP. Would using matchclass work?

 

 

if {([matchclass [IP::client_addr] equals $::filteredAddresses])}{

 

 

Where would I put this in the exiting code. I assume I would need to put it in multiple section?

 

 

Thanks

 

 

Jon
application delivery
dev
devops
iRules

3 Replies

Sort By
  • hooleylist's avatar
    hooleylist
    Icon for Cirrostratus rankCirrostratus
    Nov 05, 2008
    Hi Jon,

    You could set a variable in CLIENT_ACCEPTED if the client IP check matches and then reference that variable in each subsequent event: 

     
 when CLIENT_ACCEPTED { 
  
     Add some logic for determining which clients to log for 
    if {[matchclass [IP::client_addr] equals $::filteredAddresses]}{ 
  
       set log_this_connection 1 
  
        Get time for start of TCP connection in milleseconds 
       set tcp_start_time [clock clicks -milliseconds] 
  
        Log the start of a new TCP connection 
       log "New TCP connection from [IP::client_addr]:[TCP::client_port] to [IP::local_addr]:[TCP::local_port]" 
    } 
 } 
 when HTTP_REQUEST { 
  
     Check if we're logging this connection 
    if {$log_this_connection}{ 
  
        Get time for start of HTTP request 
       set http_request_time [clock clicks -milliseconds] 
  
        Log the start of a new HTTP request 
       set LogString "Client [IP::client_addr]:[TCP::client_port] -> [HTTP::host][HTTP::uri]" 
       log local0. "$LogString (request)" 
    } 
 } 
 when HTTP_RESPONSE { 
  
     Check if we're logging this connection 
    if {$log_this_connection}{ 
  
        Received the response headers from the server. Log the pool name, IP and port, status and time delta 
       log local0. "$LogString (response) - pool info: [LB::server] - status: [HTTP::status] (request/response\ 
          delta: [expr [clock clicks -milliseconds] - $http_request_time]ms)" 
    } 
 } 
 when CLIENT_CLOSED { 
  
     Check if we're logging this connection 
    if {$log_this_connection}{ 
  
        Log the end time of the TCP connection 
       log "Closed TCP connection from [IP::client_addr]:[TCP::client_port] to [IP::local_addr]:[TCP::local_port]\ 
          (open for: [expr [clock clicks -milliseconds] - $tcp_start_time]ms)" 
    } 
 }

    If this is the only iRule you'll ever use on the VIP, you could use 'event disable all' in CLIENT_ACCEPTED: 

     
 when CLIENT_ACCEPTED { 
  
     Add some logic for determining which clients to log for 
    if {[matchclass [IP::client_addr] equals $::filteredAddresses}{ 
  
        Get time for start of TCP connection in milleseconds 
       set tcp_start_time [clock clicks -milliseconds] 
  
        Log the start of a new TCP connection 
       log "New TCP connection from [IP::client_addr]:[TCP::client_port] to [IP::local_addr]:[TCP::local_port]" 
  
    } else { 
  
        Disable all events for this rule and any other rule for this connection 
       event disable all 
    } 
 } 
 when HTTP_REQUEST { 
     Get time for start of HTTP request 
    set http_request_time [clock clicks -milliseconds] 
  
     Log the start of a new HTTP request 
    set LogString "Client [IP::client_addr]:[TCP::client_port] -> [HTTP::host][HTTP::uri]" 
    log local0. "$LogString (request)" 
 } 
 when HTTP_RESPONSE { 
     Received the response headers from the server. Log the pool name, IP and port, status and time delta 
    log local0. "$LogString (response) - pool info: [LB::server] - status: [HTTP::status] (request/response\ 
       delta: [expr [clock clicks -milliseconds] - $http_request_time]ms)" 
 } 
 when CLIENT_CLOSED { 
     Log the end time of the TCP connection 
    log "Closed TCP connection from [IP::client_addr]:[TCP::client_port] to [IP::local_addr]:[TCP::local_port]\ 
    (open for: [expr [clock clicks -milliseconds] - $tcp_start_time]ms)" 
 }

    Aaron
  • jondyke_46152's avatar
    jondyke_46152
    Icon for Nimbostratus rankNimbostratus
    Nov 06, 2008
    Thanks for that

     

     

    I ended up adding the matchlass bit to each section and that seemed to work but your suggestions seem a bit slicker so I will try those.
  • hooleylist's avatar
    hooleylist
    Icon for Cirrostratus rankCirrostratus
    Nov 06, 2008
    The functionality is the same--it's just more efficient to use a variable versus re-running matchclass for each event.

     

     

    Aaron