Forum Discussion
Kevin_Davies
Oct 20, 2017MVP
Thats probably good for a single request however you are executing commands you don't need to. If you only need to check the first HTTP request in that connection (as their can be multiple) uncomment the event disable.
when HTTP_REQUEST {
if { ([HTTP::header "X-Application"] eq "SHARED") } {
log local0. "Client [IP::client_addr]:[TCP::client_port] -> [HTTP::host][HTTP::uri]"
event disable
}
}