Forum Discussion

Lionel_Saccoman's avatar
Lionel_Saccoman
Icon for Nimbostratus rankNimbostratus
Aug 25, 2015

HSL iRule

Hi all,

 

I send logs to a syslog using this irule :

 

when SERVER_CONNECTED {

 

set HSL_Handler [HSL::open -proto UDP -pool pool_PFCI_syslog ] HSL::send $HSL_Handler "<190> [IP::protocol];[IP::client_addr];[IP::local_addr clientside];;;[IP::local_addr];[IP::server_addr];;;\n" unset HSL_Handler }

 

The problem is that each log is prefixed with these 3 fields : Date;Time;IpAddressOfViprion" How can i remove the field IpAddressOfViprion ?

 

thanks for your help.

 

application delivery
devops
iRules
LTM

2 Replies

Sort By
  • Kevin_Stewart's avatar
    Kevin_Stewart
    Icon for Employee rankEmployee
    Aug 25, 2015

    I have to believe that this is an artifact of the syslog server itself. You're not sending these values in the syslog message. To test, set up a quick netcat syslog listener:

    nc -l -u -p1212

    and create a new pool that points to this server's IP and port 1212, then modify your iRule to point to this pool for HSL messages. The netcat listener will dump the entire message to stdout. You should not see Date;Time;IpAddressOfViprion in that output, which would imply that the syslog server is adding it.

  • Lionel_Saccoman's avatar
    Lionel_Saccoman
    Icon for Nimbostratus rankNimbostratus
    Aug 28, 2015

    After doing a test, I confirm you were right. These 3 fields are added by the syslog server.