Irule to log specific client IP to a syslog server

You can customize the way you want... Its going to be basic logging. You can create a DataGroup & add the IP's too. Then use the class match & verify with the DGL as well.

when CLIENT_ACCEPTED {
set client [IP::client_addr]
if { ( [IP::addr [IP::client_addr] equals 10.10.10.10] ) or ( [IP::addr [IP::client_addr] equals 20.20.20.20] ) or ( [IP::addr [IP::client_addr] equals 30.30.30.30] ) } {
log local0. "Client: $client has established a connection"      
 }
}

when HTTP_REQUEST {
set client_info [IP::client_addr]:[TCP::client_port]
set url [HTTP::header Host][HTTP::uri]
if { ( [IP::addr [IP::client_addr] equals 10.10.10.10] ) or ( [IP::addr [IP::client_addr] equals 20.20.20.20] ) or ( [IP::addr [IP::client_addr] equals 30.30.30.30] ) } {
log local0. "Client Source IP: $client_info is requesting URL: $url " 
}
}


when SERVER_CONNECTED {
set pool_name [LB::server pool]
if { ( [IP::addr [IP::client_addr] equals 10.10.10.10] ) or ( [IP::addr [IP::client_addr] equals 20.20.20.20] ) or ( [IP::addr [IP::client_addr] equals 30.30.30.30] ) } { 
log local0. "Client Source IP: [IP::client_addr]:[TCP::client_port] <--> POOL : $pool_name <--> ACTUALNODE <--> [IP::server_addr]:[TCP::server_port]" 
} 
}