Centralized web server log on AX

Community Forum Forums Thunder and AX Series aFleX Centralized web server log on AX

This topic contains 4 replies, has 3 voices, and was last updated by avatar techops 7 months, 1 week ago.

Viewing 5 posts - 1 through 5 (of 5 total)
  • Author
    Posts
  • #439
    avatar
    ddesmidt
    Member

    Posted by ddesmidt

    A customer just asked me today an interesting question:
    Instead of looking at the web logs individually on each server, why not using the AX to create the web logs and send these to an external centralized syslog server.
    Note: They used the w3c format, but actually as you know aFleX is pretty flexible and you can create the log format you want. The example below is for the w3c web log format.

    Code:

    when HTTP_REQUEST {
    # Set strings for the "client side"
    set time_client_request [clock seconds]
    set clicks_client_request [clock clicks -milliseconds]
    set date_time_request [clock format $time_client_request -format {%Y-%m-%d %H:%M:%S} ]
    set c_ip [IP::client_addr]
    set cs_uri_stem [HTTP::host][HTTP::uri]
    set cs_method [HTTP::method]
    set s_ip [IP::local_addr]
    set s_port [TCP::local_port]
    set host [HTTP::host]
    if {[HTTP::query] equals ""} {
    set cs_uri_query [HTTP::query]
    } else { set cs_uri_query "-"
    }
    if {[HTTP::header exists Content-Length]} {
    set cs_bytes [HTTP::header Content-Length]
    } else { set cs_bytes "-"
    }
    if {[HTTP::header exists Referer]} {
    set cs_Referer [HTTP::header "Referer"]
    } else { set cs_Referer "-"
    }
    set cs_UserAgent [string map {" " "+"} [HTTP::header "User-Agent"]]
    }


    when HTTP_RESPONSE {
    # Set strings for the "server side"
    set clicks_server_response [clock clicks -milliseconds]
    set sc_status [HTTP::status]
    if {[HTTP::header exists Content-Length]} {
    set sc_bytes [HTTP::header Content-Length]
    } else { set sc_bytes "-"
    }

    # Correct TCL Bug with floating point values
    set time_taken [expr $clicks_server_response - $clicks_client_request ]
    if {$time_taken < 10} {
    set final_time_taken [string range "0.00$time_taken" 0 4]
    } elseif { $time_taken < 100 } {
    set final_time_taken [string range "0.0$time_taken" 0 4]
    } elseif { $time_taken < 1000} {
    set final_time_taken [string range "0.$time_taken" 0 4]
    } else {
    set final_time_taken "[string index $time_taken 0].[string range $time_taken 1 3 ]"
    }

    # Format strings for logging
    set log_str "$date_time_request $c_ip $s_ip $s_port $cs_method $cs_uri_stem $cs_uri_query $sc_status $sc_bytes $cs_bytes $final_time_taken $cs_UserAgent $cs_Referer"

    # write to syslog with Debug level
    log local0.7 $log_str
    # write to AX log (turn this for troubleshooting only, as you may have a lot of requests / second)
    # log $log_str
    }

    #855
    avatar
    kberton
    Member

    Posted by kberton

    attempted to load this on my lab AX before providing it to a customer and i receive a syntax error on line 12 [HTTP::query]. complains of extra tokens in the expression.

    aFleX syntax error. Line 12: syntax error in expression “[HTTP::query] exists”: extra tokens at end of expression

    #857
    avatar
    ddesmidt
    Member

    Posted by ddesmidt

    That was to see if people used it :-)
    More seriously it’s a mistake I made in the aFleX. The “exists” option is available to test headers (such as User-Agent, Host, etc) but the query is not a header => I can’t use the option “exists”.
    So
    . Incorrect: if {[HTTP::query] exists} {
    . Correct: if {[HTTP::query] equals “”} {

    Thanks for catching it up Keith!

    Note: I have done the correction in the aFleX in the first message.

    Dimitri

    #861
    avatar
    kberton
    Member

    Posted by kberton

    Right, right, right! I read query but didn’t really *READ* it. Imports just fine and works great – thx!

    #14202
    avatar
    techops
    Member

    So from reading, this logs locally but how can I skip local logging and send straight to syslog server please?

Viewing 5 posts - 1 through 5 (of 5 total)

You must be logged in to reply to this topic.

Comments are closed.