Forum Discussion

bdavis's avatar
bdavis
Icon for Nimbostratus rankNimbostratus
Feb 25, 2010

Issue with Basic irule.

Hello all,

 

 

I was hoping someone can possibly shed some light on this issue I am having. I am a network engineer trying to be a proggrammer so bare with me. I was trying write this irule below to beable to pull a few indentifing credentials out of the http header and log them with the uri they are requesting. The problem I am seeing is the irule will log the x-forwarded-for as well as the host and uri. But it cannot seem to find the SM_USER or the SM_SESSIONSERVERID. When I perform a Tcpdump to Wireshark I can clearly see that there present. Am I just overlooking something very simple? Thank You

 

 

 

when HTTP_REQUEST {

 

set LogString "Client [HTTP::header SM_USER]:[HTTP::header SM_SERVERSESSIONID]:[HTTP::header X-Forwarded-For] -> [HTTP::host][HTTP::uri]"

 

log local3. "$LogString (request)"

 

}

5 Replies

  • Did you try putting the headers in single '

      
      when HTTP_REQUEST {   
      set LogString "Client [HTTP::header 'SM_USER']:[HTTP::header 'SM_SERVERSESSIONID']:[HTTP::header 'X-Forwarded-For'] -> [HTTP::host][HTTP::uri]"   
      log local3. "$LogString (request)"   
      }  
      

    I hope this works

    Bhattman

  • The rule you have should work fine to log the values of the headers. Are you sure SM_USER and SM_SESSIONSERVERID are HTTP header names in the request coming into the VIP? Can you post an anonmyized snippet from the tcpdump?

     

     

    Aaron
  • bdavis's avatar
    bdavis
    Icon for Nimbostratus rankNimbostratus
    I have not tried single ' I have tried double ". I will try that out and see what it does. As well as the anonmyized snippet. I am working on getting a snippet I am at home today, as well this is a secure location so I will also have to scrubb it of the values and only leave the headers names. Thanks all.
  • bdavis's avatar
    bdavis
    Icon for Nimbostratus rankNimbostratus
    This rule is working now. I did not have to change anything. when I was copying it out of wordpad, it was doing something to the format. I rewrote it directly in a new irule and it works fine. Thanks.
  • Now, if only the powers that be would have allowed me to use my original name "iRuler", I'd be a happy camper! I was able to keep the executable name of iRuler.exe though. Thanks for bringing back the memories hoolio!!!

     

     

    -Joe