Forum Discussion
3 Replies
- Andy_McGrathCumulonimbus
Some clarification please, are you trying to log all iRule log entries to different remote logging servers based on some HTTP request info?
or
Are you trying to setup something so the F5 LTM logs any standard ltm logs entries to different remote logging servers?
The first is possible and not to hard the second is not (or at at least very difficult and complex).
- Muhannad_64809Nimbostratus
Dear AMG,
My scenario is closer to the first option, i wan to create an IRule to log the events based on the matched hostname of the http request, is this feasible?
Regards, Muhannad
- Andy_McGrathCumulonimbus
You have two key options with this, you can configure multiple High Speed Logging (HSL) publisher then select the preferred publisher based on some HTTP Request data.
To do this configure your HSL publishers then in an iRule use
HSL::open -publisher
to select and open the publisher. Once done you can use the HSL handler with:
HSL::send
Example:
when HTTP_REQUEST { if {[HTTP:host] equals "www.test1.com "} { set hsl [HSL::open -publisher /Common/test1HSL] } else { set hsl [HSL::open -publisher /Common/defaultHSL] } HSL::send $hsl "<190> [IP::client_addr]:[TCP::client_port]->[IP::local_addr]:[TCP::local_port]; [HTTP::host][HTTP::uri]" }
Second option if you are not using or do not want to use HSL you can log directly within an iRule to a server or IP (which could be a VS to load balance logging) using the standard log option:
when HTTP_REQUEST { if {[HTTP:host] equals "www.test1.com "} { set logServer "192.168.0.1" } else { set logServer "192.168.0.99" } log $logServer local0.info "<190> [IP::client_addr]:[TCP::client_port]->[IP::local_addr]:[TCP::local_port]; [HTTP::host][HTTP::uri]" }
Hope this helps 🙂