Forum Discussion

N__197982's avatar
N__197982
Icon for Nimbostratus rankNimbostratus
Jan 11, 2019

iRule to log an output to syslog server.

Folks, I am looking for some changes to an iRule while will log an output to a syslog server directly. My iRule check if the connection is on TLS1.0 and if yes logs the client IP address.   The c...
application delivery
iRules
PeteWhite's avatar
PeteWhite
Icon for Employee rankEmployee
Jan 11, 2019

You want to use HSL - high-speed logging. You can do that either to a pool ( of log servers ) or via a publisher. Below is an example to a pool but i'm sure you can work out how to send it to a publisher.

when HTTP_REQUEST { 
    if { [SSL::cipher version] eq "TLSv1" } { 
        set hsl [HSL::open -proto UDP -pool syslog_server_pool]
        HSL::send $hsl "Webmail Client Source IP: [IP::client_addr]" 
    } 
}

Take a look here for details of the HSL commands