Forum Discussion

YossiV's avatar
YossiV
Icon for Nimbostratus rankNimbostratus
Nov 18, 2016

Log via HSL total response time Only when there is a spesific value

Evening all. i am using this Irule to get my total response time using @jiseruk irule here link text.

since i have more than 25 million event log per day, i dont want to log all of the response event, i want to log spesific logs that containg a spesific value base on the SOAPAction : for exmple to log only events contain SOAPAction: with the word Deposit or Withdrawal or maybe event better the whole syntax of SOAPAction like: SOAPAction: ""https://my.site.net/Deposit""; or SOAPAction: ""https://my.site.net/Withdrawal""; etc... like here:

i want to edit the irule but im gettign throuble with this the irule looks like that:

when RULE_INIT  {
set static::bigip [info hostname]
set static::facility <191>
set static::hsl_prefix "$static::facility|host=$static::bigip"
}
when CLIENT_ACCEPTED {
set hsl [HSL::open -proto UDP -pool pool-tng-graylog-HSL]   
set tcp_start_time [clock clicks -milliseconds]
}

when HTTP_REQUEST {
set http_request_time [clock clicks -milliseconds]
}

when HTTP_REQUEST_SEND  {
set http_request_send_time [clock clicks -milliseconds]
}

when LB_SELECTED  {
set lb_selected_time [clock clicks -milliseconds]
    set hsl_prefix "${static::hsl_prefix}|Winweb=[LB::server addr]|F5_ClientIP=[client_addr]"
}

when SERVER_CONNECTED  {
set connection_time [expr {[clock clicks -milliseconds] - $lb_selected_time}]
}

when HTTP_RESPONSE  {
set upstream_time [expr {[clock clicks -milliseconds] - $http_request_send_time}]
}
when HTTP_RESPONSE_RELEASE {
HSL::send $hsl "$hsl_prefix|event=X_REQUEST|total_time=[expr {[clock clicks -milliseconds] - $http_request_time}]|upstream_time=$upstream_time|connection_time=$connection_time|vserver_name=[virtual name]\n"
}

apprishiate your help

application delivery
iRules
LTM

8 Replies

Sort By
  • Niels_van_Sluis's avatar
    Niels_van_Sluis
    Icon for MVP rankMVP
    Nov 20, 2016

    I think something like this should work.

    when RULE_INIT  {
    set static::bigip [info hostname]
    set static::facility <191>
    set static::hsl_prefix "$static::facility|host=$static::bigip"
}

when CLIENT_ACCEPTED {
    set hsl [HSL::open -proto UDP -pool pool-tng-graylog-HSL]
    set tcp_start_time [clock clicks -milliseconds]
}

when HTTP_REQUEST {
    set http_request_time [clock clicks -milliseconds]

    set log_request 0
    if { [HTTP::header exists "SOAPAction"] } {
        switch -glob [string tolower [HTTP::header "SOAPAction"]] {
            "*deposit* -
            "*withdrawal* {
                set log_request 1
            }
            default {
                set log_request 0
            }
        }
    }
}

when HTTP_REQUEST_SEND  {
    set http_request_send_time [clock clicks -milliseconds]
}

when LB_SELECTED  {
    set lb_selected_time [clock clicks -milliseconds]
    set hsl_prefix "${static::hsl_prefix}|Winweb=[LB::server addr]|F5_ClientIP=[client_addr]"
}

when SERVER_CONNECTED  {
    set connection_time [expr {[clock clicks -milliseconds] - $lb_selected_time}]
}

when HTTP_RESPONSE  {
    set upstream_time [expr {[clock clicks -milliseconds] - $http_request_send_time}]
}
when HTTP_RESPONSE_RELEASE {
    if { $log_request } {
        HSL::send $hsl "$hsl_prefix|event=X_REQUEST|total_time=[expr {[clock clicks -milliseconds] -    $http_request_time}]|upstream_time=$upstream_time|connection_time=$connection_time|vserver_name=[virtual name]\n"
    }
}
  • YossiV's avatar
    YossiV
    Icon for Nimbostratus rankNimbostratus
    Nov 20, 2016

    Hi @Niels van Sluis thanks for your Replay. this irule is working but works for Header and it looks like i made a mistake and the SOAPActino is located at the message body and not at the header as i though . mean i need to look at the body. this is already made by payload ?

     

    • YossiV's avatar
      YossiV
      Icon for Nimbostratus rankNimbostratus
      Nov 21, 2016

      hi Niels i will try this and will update 10x

       

    • YossiV's avatar
      YossiV
      Icon for Nimbostratus rankNimbostratus
      Nov 22, 2016

      ok so i manged this to work (SOAPAction is now passing on the Header) so now this catch the SOAPAction from the header. but now my Quashtion now is how to log spesific events and not all SOAPAction messages. i was trying the switch -glob but than no logs came at all.

      when RULE_INIT  {set static::bigip [info hostname]
set static::facility <191>
set static::hsl_prefix "$static::facility|host=$static::bigip"
}
when CLIENT_ACCEPTED {
set hsl [HSL::open -proto UDP -pool pool-tng-graylog-HSL]   
set tcp_start_time [clock clicks -milliseconds]
}

when HTTP_REQUEST {
set http_request_time [clock clicks -milliseconds]
set  SOAPAction [HTTP::header "SOAPAction"]
set  hsl_prefix0  $SOAPAction
}

when HTTP_REQUEST_SEND  {
set http_request_send_time [clock clicks -milliseconds]
}

when LB_SELECTED  {
set lb_selected_time [clock clicks -milliseconds]
set hsl_prefix "${static::hsl_prefix}|Winweb=[LB::server addr]|F5_ClientIP=[client_addr]"
}

when SERVER_CONNECTED  {
set connection_time [expr {[clock clicks -milliseconds] - $lb_selected_time}]
}

when HTTP_RESPONSE  {
set upstream_time [expr {[clock clicks -milliseconds] - $http_request_send_time}]
}
when HTTP_RESPONSE_RELEASE {
HSL::send $hsl "$hsl_prefix|event=X_REQUEST|total_time=[expr {[clock clicks -milliseconds] -                $http_request_time}]|upstream_time=$upstream_time|connection_time=$connection_time|vserver_name=    [virtual name]\n|SOAPAction=$hsl_prefix0"
}
  • YossiV's avatar
    YossiV
    Icon for Nimbostratus rankNimbostratus
    Nov 23, 2016

    Hi Niels thanks!. looks like this is working. by the way i see that once i am using this irule ( no matter if its with the SOAPA logging or witout it) its increasing my latency from avarage of 400ms to 1200ms. what can cause this irule to make the request high?