Forum Discussion

Susheel_308346's avatar
Susheel_308346
Icon for Nimbostratus rankNimbostratus
Feb 20, 2018

Need Assistance with capturing HTTP Request and Response Details on F5 with iRule on LTM 12.X.

Need Assistance with capturing HTTP Request and Response details on F5 with iRule on LTM 12.X I'm using below iRule for capturing below fields and got stuck with http content length bytes in both request and response.

 when HTTP_REQUEST {
    set TIME [clock format [clock seconds]]
    set HOST [HTTP::host]
    set OAM [HTTP::header UID]
    set ID "[TCP::local_port][expr { int(100000000 * rand()) }]"
    set REQUEST_RECEIVE [clock clicks -milliseconds]
    set URI "[HTTP::uri]"
    set METHOD [HTTP::method]
    set hsl [HSL::open -proto TCP -pool Splunk-Heavy-Forwarder-Pool]
}

when HTTP_REQUEST_SEND {
    set REQUEST_SEND [clock clicks -milliseconds]
    set REQUEST_WAIT [expr {$REQUEST_SEND - $REQUEST_RECEIVE}]
    set SRCIP [IP::client_addr]
    HSL::send $hsl "$TIME , REQUEST , $SRCIP , $UID , $METHOD , $URI , $HOST , $ID , BYTES \n"
}

when HTTP_RESPONSE {
    set RESPONSE_TIME [expr {[clock clicks -milliseconds] - $REQUEST_SEND}]
    set STATUS [HTTP::status]
    HSL::send $hsl "$TIME , RESPONSE , $SRCIP , $UID , $METHOD , $URI , $HOST , $ID , $STATUS , BYTES , $RESPONSE_TIME\ms , $REQUEST_WAIT\ms \n"
}

1 Reply

  • I may be wrong, but you can't capture source ip in the HTTP_REQUEST_SEND. So have the variable set in the HTTP_REQUEST event itself.

    when HTTP_REQUEST {
        set SRCIP [IP::client_addr]
        log local0. "Source IP address is $SRCIP"
        }