Forum Discussion

asiosio_165682's avatar
asiosio_165682
Icon for Nimbostratus rankNimbostratus
Aug 08, 2014

iRule to log HTTP Request

Hello,

I have two F5 Big-IP:

  • 1 * BIG-IP 11.4.1 Build 647.0 Hotfix HF4
  • 1 * BIG-IP 10.2.4 Build 817.0 Hotfix HF7

I want to setup logging for HTTP traffic.

On the first F5 (11.4), no problem. I have created a request logging profile with this template:

$DATE_NCSA client=$CLIENT_IP:$CLIENT_PORT request=$HTTP_REQUEST virtual-server=$VIRTUAL_NAME($VIRTUAL_IP:$VIRTUAL_PORT) member=$SERVER_IP:$SERVER_PORT

On the second F5 (10.2), it is more complicated since the "Request logging profile" does not exist.. And i can't upgrade the device. I decided to create an iRule which produce a log with the same format (HTTP request).. But i don't know how to do.. Especially to generate "$DATE_NCSA" through the irule.

Any help would be very appreciated ! 🙂

Thanks

PS: please excuse my english 🐵

5 Replies

  • Hi Asiosio,

     

    I think the following posting might provide assistance. Please read

     

    https://devcentral.f5.com/questions/writing-an-irule-to-log-all-traffic

     

    Let us know if that helps resolve your issue?

     

  • Hi "The Bhattman", and thanks for your answer :)

     

    The problem is that i can't find the correspondance between my Request logging profile template variables ($DATE_NCSA, $HTTP_REQUEST, $VIRTUAL_NAME...) and iRule ones. For example, i do not know how to produce "$DATE_NCSA" with an iRule...

     

  • Thanks for your answers.

    I have almost made it... except for the date format.

    Indeed the request logging profile is tampered with $DATE_NCSA variable which produce something like:

    [11/Aug/2014:16:17:19 +0200]
    

    With the iRule I use the following:

    set req_start_time [clock format [clock seconds] -format "%d/%m/%y:%H:%M:%S %Z"]
    

    which produces something like:

    11/08/14:15:35:50 CEST
    

    I do not know how to make them "match" (for the syntax)..

    Thanks