Forum Discussion

oguzhansusam_25's avatar
oguzhansusam_25
Icon for Nimbostratus rankNimbostratus
Aug 09, 2018

how to send header parameter to remote syslog ?

Hi,   When http request blocked ASM profile I want see host parameter in request header on my SIEM solution. Because we have some web site on same virtual server so we dont see the blocked request...
application delivery
ASM Advanced WAF
Niels_van_Sluis's avatar
Niels_van_Sluis
Icon for MVP rankMVP
Aug 09, 2018

You could do something like this:

when CLIENT_ACCEPTED {
   set hsl [HSL::open -proto UDP -pool syslog_server_pool]
}
when HTTP_REQUEST {
    Log HTTP host and request as local7.info; see RFC 3164 Section 4.1.1 - "PRI Part" for more info
   HSL::send $hsl "<190> [IP::local_addr] [HTTP::host] [HTTP::uri]\n"
}

See: https://devcentral.f5.com/wiki/iRules.HSL__send.ashx