Chapter 58: Web Logging for HTTP and RAM

Caching
This section describes ACOS support of logging to external servers over TCP.

The following topics are covered:

Overview 907

Web Log String Customization 912

906
ACOS 5.2.1-P3 Application Delivery Controller Guide
Chapter 58: Web Logging for HTTP and RAM Caching Feedback

Overview
ACOS supports web logging for HTTP virtual ports, which can be used with HTTP load bal-
ancing or RAM caching. Web logging for load-balanced HTTP servers provides data about cli-
ent access to servers. Web logging for RAM caching provides information about client access
to content cached on the ACOS device. Web logging to external log servers is supported over
TCP and UDP. Logging over TCP is applicable to web logging for HTTP virtual ports. The rest
of this section describes this use of the feature.

Log Message Format

Web logs generated by the ACOS device use the following format:
Client-Src-IP -- Timestamp-on-ACOS-device Request-info Payload-length
Referer-info User-agent Virtual-server-name:Virtual-port

Here is an example:
20.20.20.23 - - Mon Apr 23 23:38:13 2012 "GET / HTTP/1.0" 177
"-" "Wget/1.12 (linux-gnu)" vs:80

This example uses a default log string. See Web Log String Customization for instructions on
configuring custom log strings.

Configuring Web Logging

Configuring Log Webbing (Procedure)

To configure web logging:

1. Configure real servers for each log server. Add all ports receiving log messages to these
configurations.
2. Add the log servers to a service group. Use round-robin load-balancing (the default
method).
3. (Optional – TCP Ports only) Configure TCP-proxy templates to customize TCP settings
for connections between the ACOS device and log servers.

907
ACOS 5.2.1-P3 Application Delivery Controller Guide
Chapter 58: Web Logging for HTTP and RAM Caching Feedback

For example, a TCP-Proxy template can be used to enable keepalive probes that ensure
TCP connections with log servers remain established during idle periods between logs.
(See CLI example.)
4. Configure a logging template. Add the service group containing the log servers to the
template. Add the TCP-Proxy template to the service group as required.
5. To log web traffic sent to load-balanced HTTP servers, create an HTTP template and add
the logging template to it.
6. To log web traffic served from the ACOS device’s local RAM cache, create a RAM Cach-
ing template and add the logging template to it.
7. On the VIP, add the HTTP or RAM Caching template (or both) to the HTTP virtual port.

GUI Configuration

This section describes the GUI steps related to logging templates. The configuration steps for
the real servers, service groups, and VIPs are the same as without use of logging templates.

Configuring a Logging Template

1. Hover over ADC in the menu bar, then select Template.

2. Click the General tab.
3. Click Create and select Logging from the drop-down menu.
4. Enter a name for the template.
5. Select the service group that contains the log servers.
6. If a custom TCP-proxy template for logging is configured, select it from the TCP Proxy
list.
7. Click OK.

Applying a Logging Template to an HTTP Template

1. Hover over ADC in the menu bar, then select Template.

2. Click the L7 Protocols tab.
3. Click Create and select HTTP from the drop-down menu.
4. Enter a name for the template.

908
ACOS 5.2.1-P3 Application Delivery Controller Guide
Chapter 58: Web Logging for HTTP and RAM Caching Feedback

5. Select the logging template from the drop-down list in the Logging Template field.
6. Click OK.

Applying a Logging Template to a RAM Caching Template

1. Hover over ADC in the menu bar, then select Template.

2. Click the Applications tab.
3. Click Create and select RAM Caching from the drop-down menu.
4. Enter a name for the template.
5. Select the logging template from the drop-down list in the Logging Template field.
6. Click OK.

CLI Configuration

Configuring a Logging Template

To configure a logging template, use the slb template logging command to change the CLI
to the configuration level for the template, where the service-group command is available to
specify the name of the service group that contains the log servers.

This template tcp-proxy command specifies the name of the TCP-proxy template to use for
managing TCP sessions between the ACOS device and the log servers.

Applying a Log Template to an HTTP Template

Use the template logging command at the configuration level for the HTTP template:

Applying a Log Template to a RAM Caching Template

Use the template logging command at the configuration level for the RAM Caching tem-
plate:

Configuring Log Webbing (CLI Example)

The following commands configure web logging for an IPv4 virtual port and an IPv6 virtual
port. On each virtual port, web logging is enabled both for HTTP load-balanced client-server
traffic and for client access to content that is cached in the ACOS device's RAM cache.

909
ACOS 5.2.1-P3 Application Delivery Controller Guide
Chapter 58: Web Logging for HTTP and RAM Caching Feedback

In this example, two real servers are used as HTTP content servers and as logging servers. Cli-
ents send requests for HTTP content to port 80. ACOS either serves the requested from the
local RAM cache, if available, or sends the request to one of the servers.

In this example, the ACOS device uses the same servers as the content servers and as the log-
ging servers. Client requests for HTTP content are sent to port 80. Log traffic is sent to one of
the following ports:

l 4999 – TCP port listening for log traffic sent over IPv4.
l 5999 – TCP port listening for log traffic sent over IPv6.

To begin, the following commands configure the servers:

ACOS(config)# slb server rs 10.10.10.11
ACOS(config-real server)# port 80 tcp
ACOS(config-real server-node port)# exit
ACOS(config-real server)# port 4999 tcp
ACOS(config-real server-node port)# exit
ACOS(config-real server)# port 5140 udp
ACOS(config-real server-node port)# exit
ACOS(config-real server)# exit
ACOS(config)# slb server rs6 3030::3011
ACOS(config-real server)# port 80 tcp
ACOS(config-real server-node port)# exit
ACOS(config-real server)# port 5999 tcp
ACOS(config-real server-node port)# exit
ACOS(config-real server)# port 6140 udp
ACOS(config-real server-node port)# exit
ACOS(config-real server)# exit

These commands configure service groups for the logging and application servers accessed
by clients:
ACOS(config)# slb service-group logsg tcp
ACOS(config-slb svc group)# member rs 80
ACOS(config-slb svc group-member:80)# exit
ACOS(config-slb svc group)# exit
ACOS(config)# slb service-group udpsg udp
ACOS(config-slb svc group)# member rs 5140
ACOS(config-slb svc group-member:5140)# exit
ACOS(config-slb svc group)# exit
ACOS(config)# slb service-group v6logsg tcp
ACOS(config-slb svc group)# member rs6 80
ACOS(config-slb svc group-member:80)# exit

910
ACOS 5.2.1-P3 Application Delivery Controller Guide
Chapter 58: Web Logging for HTTP and RAM Caching Feedback

ACOS(config-slb svc group)# exit

ACOS(config)# slb service-group udpsg6 udp
ACOS(config-slb svc group)# member rs6 6140
ACOS(config-slb svc group-member:6140)# exit
ACOS(config-slb svc group)# exit

The following commands configure the TCP-proxy template, to enable keepalive probes:
ACOS(config)# slb template tcp-proxy logtcp
ACOS(config-TCP proxy template)# keepalive-probes 4
ACOS(config-TCP proxy template)# exit

The following commands configure the logging templates:

ACOS(config)# slb template logging logtemp
ACOS(config-logging)# service-group logsg
ACOS(config-logging)# template tcp-proxy logtcp
ACOS(config-logging)# exit
ACOS(config)# slb template logging udplog
ACOS(config-logging)# service-group udpsg
ACOS(config-logging)# exit
ACOS(config)# slb template logging logtemp6
ACOS(config-logging)# service-group v6logsg
ACOS(config-logging)# template tcp-proxy logtcp
ACOS(config-logging)# exit
ACOS(config)# slb template logging udplog6
ACOS(config-logging)# service-group udpsg6
ACOS(config-logging)# exit

The following commands configure the RAM caching templates:

ACOS(config)# slb template cache logcache
ACOS(config-ram caching)# min-content-size 20
ACOS(config-ram caching)# template logging udplog
ACOS(config-ram caching)# exit
ACOS(config)# slb template cache logcache6
ACOS(config-ram caching)# min-content-size 20
ACOS(config-ram caching)# template logging udplog6
ACOS(config-ram caching)# exit

The following commands configure the HTTP templates:

ACOS(config)# slb template http loghttp
ACOS(config-http)# template logging logtemp
ACOS(config-http)# exit
ACOS(config)# slb template http loghttp6
ACOS(config-http)# template logging logtemp6
ACOS(config-http)# exit

911
ACOS 5.2.1-P3 Application Delivery Controller Guide
Chapter 58: Web Logging for HTTP and RAM Caching Feedback

These commands configure the VIPs. The configuration of the snat and snat6 NAT pool ref-
erenced in the example is not included.
ACOS(config)# slb virtual-server vs 20.20.20.25
ACOS(config-slb vserver)# port 80 http
ACOS(config-slb vserver-vport)# source-nat pool snat
ACOS(config-slb vserver-vport)# service-group logsg
ACOS(config-slb vserver-vport)# template http loghttp
ACOS(config-slb vserver-vport)# template cache logcache
ACOS(config-slb vserver-vport)# exit
ACOS(config-slb vserver)# exit
ACOS(config)# slb virtual-server vs6 2020::2025
ACOS(config-slb vserver)# port 80 http
ACOS(config-slb vserver-vport)# source-nat pool snat6
ACOS(config-slb vserver-vport)# service-group v6logsg
ACOS(config-slb vserver-vport)# template http loghttp6
ACOS(config-slb vserver-vport)# template cache logcache6
ACOS(config-slb vserver-vport)# exit
ACOS(config-slb vserver)# exit

Web Log String Customization

You can customize the structure and content of web log messages for requests sent to HTTP
or HTTPS virtual ports. This capability customizes ACOS to efficiently log only the information
that you require.

W3C Log Message Format

The CLI can modify web logging formats with the format command at the logging template
configuration level. The logging template bound to the virtual server constructs log messages
for HTTP/HTTPS requests according to the specified format.

For example, if the log message format is defined as shown below:

%{%Y-%m-%d %H:%M:%S}t %a %u %A %p %r %m %U %q %s "%{USER-AGENT}i" "%{REFERER}i"
%H %v %b

Then the log message for an HTTP request is constructed as follows:

2018-02-08 19:30:53 11.0.0.40 2013-02-01 15:31:08 11.0.0.1 - 10.1.2.198 80 s1
GET /aa/cookie.htm - 200 "Wget/1.12 (linux-gnu)" "OK" HTTP/1.0 vip1 32494

912
ACOS 5.2.1-P3 Application Delivery Controller Guide
Chapter 58: Web Logging for HTTP and RAM Caching Feedback

In this log message, Feb 1 19:30:53 is the timestamp of when the log was received. The IP
address of the server that received the log is 11.0.0.40. The remaining content of the log
message is constructed according to the format string (defined by the format command that
is configured within the logging template).

W3C Format Characters

TABLE 58-1 describes W3C format characters supported on the ACOS device and references
content in the example log message above.

TABLE 58-1 : W3C – Format Characters

Format Char- Description Log Message Example

acter

%% Percent symbol N/A

%a Client IP address 11.0.0.1

%A Local IP address 10.1.2.198

%p Port number that is used by the server for 80

a request

%r Name of the real server s1

%m HTTP request method GET

%U Requested URL path requested /aa/cookie.htm

The log message does not include any

query strings

%q Query string in a request The second “-”

%u For authenticated requests, the %u format The first “-”

character logs the remote user

ACOS does not authenticate HTTP

requests. Therefore, %u format character
always return a null (-) value.

913
ACOS 5.2.1-P3 Application Delivery Controller Guide
Chapter 58: Web Logging for HTTP and RAM Caching Feedback

Format Char- Description Log Message Example

acter

%s HTTP status code for the request 200

In RAM Caching deployments, the status

code is not included in log messages; the
%s format character returns a null (-)
value in web logging messages.

%{time}t Timestamp for when the request is pro- 2013-02-01 15:31:08

cessed

For time you can specify the following:

%Y – year

%m – month

%d – day

%H – hour

%M – minute

%S – seconds

%{USER-AGENT}i User-agent sending the request “Wget/1.12 (linux-

gnu)”

%{REFERER}i Referer of a request “OK”

%H HTTP request protocol HTTP/1.0

914
ACOS 5.2.1-P3 Application Delivery Controller Guide
Chapter 58: Web Logging for HTTP and RAM Caching Feedback

Format Char- Description Log Message Example

acter

%v Name of the virtual server that processed Vip1

the request

Content for this value differs for virtual

servers defined on shared or private par-
titions. For example, if the virtual server
“vipv6” is defined in a partition named
“l3v”, then %v is parsed as “?l3v?vipv6” in
the web log message.

%b Number of bytes in the response 32494

W3C Control Characters

In addition to the format characters described in W3C – Format Characters, ACOS supports
the following control characters:

l \\n – New line

l \\t – Carriage return (reset to the line beginning)

l \\r – Tab

W3C Format Consideration

If the format of a string includes an unsupported character, the log message will contain only
the first section of valid information leading up to the unsupported character. Even if the log
message contains supported content after the unsupported character, the latter section of
supported content is not included in the log message. For example, given the structure
below:
<supported “A”><unsupported “B”><supported “C”>

The log message breaks at <unsupported “B”>, displaying only content associated with <sup-
ported “A”>.

For example, given the logging format “%P%A%a%p”, “%P” is not supported and as a result noth-
ing is parsed into a log message.

915
ACOS 5.2.1-P3 Application Delivery Controller Guide
Chapter 58: Web Logging for HTTP and RAM Caching Feedback

For the logging format “%p%P%a%A”, the content after the unsupported “%P” format character
is not included in the log message and the information for “%p” is the only content parsed into
a log message.

To view which characters are parsed in a format string, use the show slb template logging
command.

Do not use the question mark (?) as a literal character for log messages.

Configuring Web Logging Format

Perform the following commands to customize Web log messages.

GUI Configuration

1. Hover over ADC in the menu bar, then select Template.

2. Click the General tab.
3. Click Create and select Logging from the drop-down menu.
4. In the Format field enter the series of up to 250 supported format characters. See W3C
– Format Characters for information about format characters.
5. Click OK.

CLI Configuration

This example shows how to use the format command to create a log format, then use the
show slb template logging command to verify the configuration:
ACOS(config)# slb template logging v-log
ACOS(config-logging)# format %a \n "%a"
ACOS(config-logging)# show slb template logging
slb template logging v-log
format %a \n "%a"
ACOS(config-logging)#

916