Forum Discussion
2 Replies
- Eric_Weiss_2486Nimbostratus
Nevermind, I was able to put one together. Here it is:
when HTTP_REQUEST { set LogStringNonProd "Client [IP::client_addr]:[TCP::client_port] -> [HTTP::host][HTTP::uri]" Check for 'X-Application: SHARED' if { ([HTTP::header value "X-Application"] contains "SHARED") } { log local0. " " log local0. "===================================================" log local0. "$LogStringNonProd (request)" log local0. "X-Application is set to SHARED for this connection." log local0. "===================================================" log local0. " " } }
Thats probably good for a single request however you are executing commands you don't need to. If you only need to check the first HTTP request in that connection (as their can be multiple) uncomment the event disable.
when HTTP_REQUEST { if { ([HTTP::header "X-Application"] eq "SHARED") } { log local0. "Client [IP::client_addr]:[TCP::client_port] -> [HTTP::host][HTTP::uri]" event disable } }