Forum Discussion

Eric_Weiss_2486's avatar
Eric_Weiss_2486
Icon for Nimbostratus rankNimbostratus
Oct 19, 2017

Looking for iRule that logs source IP & destination URL when header "X-Application=SHARED"

Hello, I'm looking for an iRule that may already exist, which would log the source IP and URL destination when header “X-Application=SHARED”. The goal of this is to try and identify where an invalid X-Application header is coming from on a service.

 

Thank you for any help you may be able to provide.

 

Eric

 

2 Replies

  • Nevermind, I was able to put one together. Here it is:

     

    when HTTP_REQUEST { set LogStringNonProd "Client [IP::client_addr]:[TCP::client_port] -> [HTTP::host][HTTP::uri]" Check for 'X-Application: SHARED' if { ([HTTP::header value "X-Application"] contains "SHARED") } { log local0. " " log local0. "===================================================" log local0. "$LogStringNonProd (request)" log local0. "X-Application is set to SHARED for this connection." log local0. "===================================================" log local0. " " } }

     

  • Thats probably good for a single request however you are executing commands you don't need to. If you only need to check the first HTTP request in that connection (as their can be multiple) uncomment the event disable.

    when HTTP_REQUEST {
        if { ([HTTP::header "X-Application"] eq "SHARED") } {
            log local0. "Client [IP::client_addr]:[TCP::client_port] -> [HTTP::host][HTTP::uri]"
             event disable
        }
    }