Logging all traffic iRule.

SERVER_CONNECTED is an event that's fired when the LTM makes a connection to the backend node, so if the client connects and disconnects before the LTM ever makes a connection to the backend, you won't have those variables.

I'd recommend moving at least the

client

snat

node

Thank you Michael.

I have done something like this, and I am about to test it in next few days:

when CLIENT_ACCEPTED {
   set client "[IP::client_addr]:[TCP::client_port]"
   set vip "[IP::local_addr]:[TCP::local_port]"
   set snat "unknown"
   set node "unknown"
}

when SERVER_CONNECTED {
   set snat "[IP::local_addr]:[TCP::local_port]"
   set node "[IP::server_addr]:[TCP::server_port]"
}

when CLIENT_CLOSED {
    log connection info
   log local0.info "Client $client -> VIP: $vip -> SNAT: $snat -> Node: $node"
}

Hi Michael J,

Would you mind checking the above and let us know if the above example is suitable please?

Thanks.

i have tested your irule on my Virtual F5 and my 4000 , it passed fine.

What is the irule for log header only from one IP.

Unless this is for debugging purposes, log your traffic but it is not the best approach. Better option is taking a capture. If you have to use the iRule, then after debugging, please comment the log local.0 or remove the iRule from the virtual server. You don't want to fill up your LTM logs that are meant for system logs.

to add 'add http profile' you will need to add when HTTP_REQUEST event.