Forum Discussion

Sean_Adams_2420's avatar
Sean_Adams_2420
Icon for Nimbostratus rankNimbostratus
Mar 30, 2017

Help with an iRule to log RPC activity

I am familiar with HTTP iRules but not so much with TCP/RPC within iRules. I am trying to log RPC traffic. Our F5 proxies RPC traffic over port 60,0000 to a pool of CAS servers. I'm thinking I can setup an iRule on the proxy backend that would use a combination of server_connected, tcp::collect and tcp::payload to generate the logs and push to our Splunk system to present the answer. I'm familiar with HTTP logging but not TCP/RPC logging ... My dashboard in Splunk would probably show a table of client_ip, start of connection, timechart of traffic events/hits since open.

 

application delivery
iRules
rpc

1 Reply

Sort By
  • Sean_Adams_2420's avatar
    Sean_Adams_2420
    Icon for Nimbostratus rankNimbostratus
    Mar 30, 2017

    I am trying to differentiate between the RPC connections that are open and passing active traffic to the RPC connections that are open and not passing traffic but being kept open based on a server keep-alive setting. I think if I can track an open connection and construct a timechart or capture total count of event/traffic since open, I could solve the question.

     

    I am seeking assistance on an constructing an iRule or advice on a different approach. Thank You!