Forum Discussion

tomasz_su_15025's avatar
tomasz_su_15025
Icon for Nimbostratus rankNimbostratus
Nov 17, 2017

Is there something like iRule instance ID that could be printed easily on the ltm log?

My understanding is that each connection will be handled by a dedicated iRule instance. Let's say I got some basic logging implemented i.e.: log local0. "Pool member $pool_mbr selected" But I got many simultaneous connections from the same client even, and I would want to be able to filter all the log lines just for a single specific connection flow. Now the solution would be to prefix each log line message with some connection details, allowing filtering with grepping the ltm log. However was wondering if there is maybe something like an iRule instance ID i.e. something that is unique per flow that could be easily printed/appended on each log line produced? Examining ltm log I can see that by default log lines produced by the iRule are just prefixed with tmm instance id and pid i.e: Nov 9 05:11:26 big-ip info tmm1[15151]: Rule /Common/...

 

2 Replies

  • This is application specific and recommend identifying something on the application side that is used for session identification as even if some iRule session ID is available it would only be for the single execution of the the set of iRules.

     

    For example if you have a Web App that uses JSESSIONID cookies/headers then I would log using that bit of info.

     

    It is hard on the F5 side as you can identify a TCP or SSL connection/session with easy but that only works if you have a single TCP connection for each application session. For example HTTP this would not work as you could have many connections over the course of a users sessions or something like a proxy upstream doing HTTP multiplexing.

     

    If this helps please up vote my answer/comment.

     

  • I'm not aware of an instance ID - but you could generate logging with a random string:

    set logPrefix "[IP::client_addr]:[TCP::client_port]:[IP::server_addr]:[TCP::server_port][expr { int(100000000 * rand()) }]"