KimiLi_147173
Dec 26, 2018Nimbostratus
Is it possible to log how many bytes an APM session gets?
Hi guys, we have an irule below to collect http log :
when CLIENT_ACCEPTED {
set syslog_server_pool pool_splunk_syslog_udp511_lan
set hsl [HSL::open -proto UDP -pool $syslog_server_pool]
}
when HTTP_REQUEST {
set req_start [clock clicks -milliseconds]
set cs_username [ACCESS::session data get "session.logon.last.username"]
set cs_uri_stem [HTTP::path]
set cs_uri_query [HTTP::query]
set cs_bytes [HTTP::header Content-Length]
set ua [HTTP::header User-Agent]
set cookies [HTTP::header values Cookie]
set referer [HTTP::header Referer]
}
when HTTP_RESPONSE {
HSL::send $hsl "[string map [list "\t \t" "\t-\t"]\
"<134>\t\
[info hostname]\t\
[IP::local_addr]\t\
[clock format [clock seconds] -format "%d/%m/%Y %H:%M:%S %z"]\t\
[IP::client_addr]\t\
$cs_username\t\
[clientside {IP::local_addr}]\t\
$cs_uri_stem\t\
$cs_uri_query\t\
[HTTP::status]\t\
[HTTP::header Content-Length]\t\
[expr {[clock clicks -milliseconds] - $req_start}]\t\
[HTTP::version]\t\
\"$ua\"\t\
$cookies\t\
$referer\
"]\n"
}
now we would like to have the information in HSL log that how much data an APM session gets in total, since we do not know the application very well, we can only assume that parts of data are in http body but not header.
Is it possible to log how many bytes an APM session gets and how to achieve that? Thanks a lot and merry Xmas!