Feedback ACOS 4.1.

4-GR1-P11 Application Delivery Controller Guide

WEB LOGGING FOR HTTP AND RAM CACHING

This chapter describes ACOS support of logging to external servers over TCP. Sections in this
chapter include:

Web Logging Overview

Web Log String Customization

Web Logging Overview

ACOS supports web logging for HTTP virtual ports, which can be used with HTTP load balancing
or RAM caching. Web logging for load-balanced HTTP servers provides data about client access
to servers. Web logging for RAM caching provides information about client access to content
cached on the ACOS device. Web logging to external log servers is supported over TCP and UDP.
Logging over TCP is applicable to web logging for HTTP virtual ports. The rest of this chapter
describes this use of the feature.

Log Message Format

Web logs generated by the ACOS device use the following format:

Here is an example:

This example uses a default log string. See “Web Log String Customization” on page 822 for
instructions on configuring custom log strings.
ACOS 4.1.4-GR1-P11 Application Delivery Controller Guide FeedbackF
Fee
e
Web Logging Overview

Configuring Web Logging

To configure web logging:

1. Configure real servers for each log server. Add all ports receiving log messages to these
configurations.
2. Add the log servers to a service group. Use round-robin load-balancing (the default
method).
3. (Optional – TCP Ports only) Configure TCP-proxy templates to customize TCP settings for
connections between the ACOS device and log servers.
For example, a TCP-Proxy template can be used to enable keepalive probes that ensure
TCP connections with log servers remain established during idle periods between logs. (See
CLI example.)
4. Configure a logging template. Add the service group containing the log servers to the tem-
plate. Add the TCP-Proxy template to the service group as required.
5. To log web traffic sent to load-balanced HTTP servers, create an HTTP template and add
the logging template to it.
6. To log web traffic served from the ACOS device’s local RAM cache, create a RAM Caching
template and add the logging template to it.
7. On the VIP, add the HTTP or RAM Caching template (or both) to the HTTP virtual port.

This section describes the GUI steps related to logging templates. The configuration steps for
the real servers, service groups, and VIPs are the same as without use of logging templates.

1. Hover over ADC in the menu bar, then select Template.

2. Click the General tab.
3. Click Create and select Logging from the drop-down menu.
4. Enter a name for the template.
5. Select the service group that contains the log servers.
6. If a custom TCP-proxy template for logging is configured, select it from the TCP Proxy list.
7. Click OK.
Feedback ACOS 4.1.4-GR1-P11 Application Delivery Controller Guide
Web Logging Overview

1. Hover over ADC in the menu bar, then select Template.

2. Click the L7 Protocols tab.
3. Click Create and select HTTP from the drop-down menu.
4. Enter a name for the template.
5. Select the logging template from the drop-down list in the Logging Template field.
6. Click OK.

1. Hover over ADC in the menu bar, then select Template.

2. Click the Applications tab.
3. Click Create and select RAM Caching from the drop-down menu.
4. Enter a name for the template.
5. Select the logging template from the drop-down list in the Logging Template field.
6. Click OK.

To configure a logging template, use the command to change the CLI to

the configuration level for the template, where the command is available to
specify the name of the service group that contains the log servers.

This command specifies the name of the TCP-proxy template to use for
managing TCP sessions between the ACOS device and the log servers.

Use the command at the configuration level for the HTTP template:

Use the command at the configuration level for the RAM Caching template:

The following commands configure web logging for an IPv4 virtual port and an IPv6 virtual port.
On each virtual port, web logging is enabled both for HTTP load-balanced client-server traffic
and for client access to content that is cached in the ACOS device's RAM cache.
ACOS 4.1.4-GR1-P11 Application Delivery Controller Guide FeedbackF
Fee
e
Web Logging Overview

In this example, two real servers are used as HTTP content servers and as logging servers.
Clients send requests for HTTP content to port 80. ACOS either serves the requested from the
local RAM cache, if available, or sends the request to one of the servers.

In this example, the ACOS device uses the same servers as the content servers and as the
logging servers. Client requests for HTTP content are sent to port 80. Log traffic is sent to one of
the following ports:

4999 – TCP port listening for log traffic sent over IPv4.
5999 – TCP port listening for log traffic sent over IPv6.

To begin, the following commands configure the servers:

These commands configure service groups for the logging and application servers accessed by
clients:
Feedback ACOS 4.1.4-GR1-P11 Application Delivery Controller Guide
Web Logging Overview

The following commands configure the TCP-proxy template, to enable keepalive probes:

The following commands configure the logging templates:

The following commands configure the RAM caching templates:

The following commands configure the HTTP templates:

ACOS 4.1.4-GR1-P11 Application Delivery Controller Guide FeedbackF
Fee
e
Web Log String Customization

These commands configure the VIPs. The configuration of the snat and snat6 NAT pool
referenced in the example is not included.

Web Log String Customization

You can customize the structure and content of web log messages for requests sent to HTTP or
HTTPS virtual ports. This capability customizes ACOS to efficiently log only the information that
you require.

W3C Log Message Format

The CLI can modify web logging formats with the command at the logging template
configuration level. The logging template bound to the virtual server constructs log messages
for HTTP/HTTPS requests according to the specified format.

For example, if the log message format is defined as shown below:

Then the log message for an HTTP request is constructed as follows:

In this log message, is the timestamp of when the log was received. The IP
address of the server that received the log is . The remaining content of the log
Feedback ACOS 4.1.4-GR1-P11 Application Delivery Controller Guide
Web Log String Customization

message is constructed according to the format string (defined by the command that is
configured within the logging template).

W3C Format Characters Supported on the ACOS device

Table 24 describes W3C format characters supported on the ACOS device and references
content in the example log message above.

TABLE 24 : W3C – Format Characters

Format Character Description Log Message Example
Percent symbol N/A
Client IP address
Local IP address
Port number that is used by the server for a
request
Name of the real server
HTTP request method
Requested URL path requested

The log message does not include any query

strings
Query string in a request The second “-”
For authenticated requests, the format char- The first “-”
acter logs the remote user

ACOS does not authenticate HTTP requests.

Therefore, format character always return a
null (-) value.
HTTP status code for the request

In RAM Caching deployments, the status code is

not included in log messages; the %s format
character returns a null (-) value in web logging
messages.
Timestamp for when the request is processed

For you can specify the following:

– year
– month
– day
– hour
– minute
– seconds
User-agent sending the request
Referer of a request
HTTP request protocol
ACOS 4.1.4-GR1-P11 Application Delivery Controller Guide FeedbackF
Fee
e
Web Log String Customization

TABLE 24 : W3C – Format Characters (Continued)

Format Character Description Log Message Example
Name of the virtual server that processed the
request

Content for this value differs for virtual servers

defined on shared or private partitions. For exam-
ple, if the virtual server “vipv6” is defined in a par-
tition named “l3v”, then is parsed as
“?l3v?vipv6” in the web log message.
Number of bytes in the response

W3C Control Characters Supported on the ACOS device

In addition to the format characters described in Table 24, ACOS supports the following control
characters:

– New line
– Carriage return (reset to the line beginning)
– Tab

W3C Format Consideration

If the format of a string includes an unsupported character, the log message will contain only
the first section of valid information leading up to the unsupported character. Even if the log
message contains supported content after the unsupported character, the latter section of
supported content is not included in the log message. For example, given the structure below:

The log message breaks at , displaying only content associated with

.

For example, given the logging format “ ”, “ ” is not supported and as a result nothing is
parsed into a log message.

For the logging format “ ”, the content after the unsupported “ ” format character is
not included in the log message and the information for “ ” is the only content parsed into a log
message.

To view which characters are parsed in a format string, use the

command.

Do not use the question mark (?) as a literal character for log messages.
Feedback ACOS 4.1.4-GR1-P11 Application Delivery Controller Guide
Web Log String Customization

Configuring Web Logging Format

Perform the following commands to customize Web log messages.

1. Hover over ADC in the menu bar, then select Template.

2. Click the General tab.
3. Click Create and select Logging from the drop-down menu.
4. In the Format field enter the series of up to 250 supported format characters. See Table 24
for information about format characters.
5. Click OK.

This example shows how to use the command to create a log format, then use the
command to verify the configuration: