Logging traffic flows in syslog

mike_larue@agilent.com · March 2011

Posted by mike_larue@agilent.com

We are looking for a way to log traffic flows in syslog so that we can get a clear picture of the client IP/VIP and SNAT/Server IP binding. We woudl like to see:

timestamp; client IP; VIP; SNAT IP; Real Server for each flow that is created. Do you have the aFlex code available for this?

Thanks,
Mike

[Deleted User] · March 2011

Posted by ddesmidt

You can find some examples here:
http://www.a10networks.com/vadc/index.php/forums/topic/centralized-server-log-not-web-on-ax/

But here you go a nice aFleX that replies to your need

Code:

when CLIENT_ACCEPTED {
# Set strings for the "client side"
set time_client_connection [clock seconds]
set date_time_request [clock format $time_client_connection -format {%Y-%m-%d %H:%M:%S} ]
set c_ip [IP::client_addr]
set c_port [TCP::client_port]
set vip_ip [IP::local_addr]
set vip_port [TCP::local_port]
}


when SERVER_CONNECTED {
# Set strings for the "server side"
set s_ip [IP::server_addr]
set s_port [TCP::server_port]
set snat_ip [IP::local_addr]
set snat_port [TCP::local_port]
# Format strings for logging
set log_str "$date_time_request - $c_ip:$c_port => $vip_ip:$vip_port \t TO \t $snat_ip:$snat_port => $s_ip:$s_port"

# write to syslog with Debug level
log local0.7 $log_str
# write to AX log (turn this for troubleshooting only, as you may have a lot of connections / second)
log $log_str
}

Dimitri

Logging traffic flows in syslog

Comments