Forum Discussion
youssef1
Apr 04, 2019Cumulonimbus
Hi,
Can you begin with trying this irule please (we will optimize it later):
when HTTP_REQUEST {
set capture 0
if { [HTTP::header exists Content-length] and [HTTP::method] equals "POST" } {
set capture 1
HTTP::collect [HTTP::header Content-Length]
}
}
when HTTP_REQUEST_DATA {
if {$capture} {
set payload [HTTP::payload]
regexp {^.*([^\"]+)<\/a:Action>.*$} $capture -> action
log local0. "action: $action"
}
}