F5 BIG-IP - iRules: Difference between revisions

From IT-Arts.net
Created page with "Category:Wiki '''''[https://it-arts.net/index.php/Category:Wiki Return to Wiki Index]''''' == Viewing iRules == === Viewing All iRules === To display all configured iRules, use the following command: <nowiki>tmsh show ltm rule</nowiki> This command lists all iRules on the system along with their current status. === Viewing a Specific iRule === To view a specific iRule by name, use: <nowiki>tmsh show ltm rule <iRule_name></nowiki> Example: <nowiki>tmsh show lt..."
 
No edit summary
 
(2 intermediate revisions by the same user not shown)
Line 8: Line 8:
To display all configured iRules, use the following command:
To display all configured iRules, use the following command:


<nowiki>tmsh show ltm rule</nowiki>
<nowiki>
tmsh show ltm rule</nowiki>


This command lists all iRules on the system along with their current status.
This command lists all iRules on the system along with their current status.
Line 15: Line 16:
To view a specific iRule by name, use:
To view a specific iRule by name, use:


<nowiki>tmsh show ltm rule <iRule_name></nowiki>
<nowiki>
tmsh show ltm rule <iRule_name></nowiki>


Example:
Example:
<nowiki>tmsh show ltm rule myrule</nowiki>
<nowiki>
tmsh show ltm rule myrule</nowiki>


This command will display the full content of the `myrule` iRule.
This command will display the full content of the `myrule` iRule.
Line 27: Line 30:
To create a new iRule, use the following command:
To create a new iRule, use the following command:


<nowiki>tmsh create ltm rule <iRule_name> { <iRule_script> }</nowiki>
<nowiki>
tmsh create ltm rule <iRule_name> { <iRule_script> }</nowiki>


Example:
Example:
<nowiki>tmsh create ltm rule myrule { when HTTP_REQUEST { log local0. "Received HTTP request" } }</nowiki>
<nowiki>
tmsh create ltm rule myrule { when HTTP_REQUEST { log local0. "Received HTTP request" } }</nowiki>


This creates an iRule named `myrule` that logs an entry for each HTTP request received.
This creates an iRule named `myrule` that logs an entry for each HTTP request received.
Line 37: Line 42:
To modify an existing iRule, use:
To modify an existing iRule, use:


<nowiki>tmsh modify ltm rule <iRule_name> { <new_iRule_script> }</nowiki>
<nowiki>
tmsh modify ltm rule <iRule_name> { <new_iRule_script> }</nowiki>


Example:
Example:
<nowiki>tmsh modify ltm rule myrule { when HTTP_REQUEST { log local0. "Received HTTP request with URI: [HTTP::uri]" } }</nowiki>
<nowiki>
tmsh modify ltm rule myrule { when HTTP_REQUEST { log local0. "Received HTTP request with URI: [HTTP::uri]" } }</nowiki>


This modifies the `myrule` iRule to log the URI of each HTTP request.
This modifies the `myrule` iRule to log the URI of each HTTP request.
Line 47: Line 54:
To delete an iRule, use:
To delete an iRule, use:


<nowiki>tmsh delete ltm rule <iRule_name></nowiki>
<nowiki>
tmsh delete ltm rule <iRule_name></nowiki>


Example:
Example:
<nowiki>tmsh delete ltm rule myrule</nowiki>
<nowiki>
tmsh delete ltm rule myrule</nowiki>


This deletes the `myrule` iRule from the system.
This deletes the `myrule` iRule from the system.
Line 60: Line 69:
An iRule consists of **event blocks**, which trigger actions based on specific traffic events. The basic syntax of an iRule looks like this:
An iRule consists of **event blocks**, which trigger actions based on specific traffic events. The basic syntax of an iRule looks like this:


<nowiki>
<nowiki>
when <event> {
when <event> {
     <action>
     <action>
}
}</nowiki>
</nowiki>


Example:
Example:
<nowiki>
<nowiki>
when CLIENTSSL_HANDSHAKE {
when CLIENTSSL_HANDSHAKE {
     log local0. "SSL handshake initiated"
     log local0. "SSL handshake initiated"
}
}</nowiki>
</nowiki>


### Common Events in iRules
### Common Events in iRules
Line 89: Line 96:
### Example iRule for HTTP Request Logging
### Example iRule for HTTP Request Logging


<nowiki>
<nowiki>
when HTTP_REQUEST {
when HTTP_REQUEST {
     log local0. "Received HTTP request: [HTTP::uri]"
     log local0. "Received HTTP request: [HTTP::uri]"
}
}</nowiki>
</nowiki>


This iRule logs each HTTP request's URI to the system log.
This iRule logs each HTTP request's URI to the system log.
Line 101: Line 107:
To assign an iRule to a virtual server, use the following command:
To assign an iRule to a virtual server, use the following command:


<nowiki>tmsh modify ltm virtual <vs_name> rules add { <iRule_name> }</nowiki>
<nowiki>
tmsh modify ltm virtual <vs_name> rules add { <iRule_name> }</nowiki>


Example:
Example:
<nowiki>tmsh modify ltm virtual my_virtual_server rules add { myrule }</nowiki>
<nowiki>
tmsh modify ltm virtual my_virtual_server rules add { myrule }</nowiki>


This command adds the `myrule` iRule to the `my_virtual_server` virtual server.
This command adds the `myrule` iRule to the `my_virtual_server` virtual server.
Line 111: Line 119:
To remove an iRule from a virtual server, use:
To remove an iRule from a virtual server, use:


<nowiki>tmsh modify ltm virtual <vs_name> rules delete { <iRule_name> }</nowiki>
<nowiki>
tmsh modify ltm virtual <vs_name> rules delete { <iRule_name> }</nowiki>


Example:
Example:
<nowiki>tmsh modify ltm virtual my_virtual_server rules delete { myrule }</nowiki>
<nowiki>
tmsh modify ltm virtual my_virtual_server rules delete { myrule }</nowiki>


This removes the `myrule` iRule from the `my_virtual_server` virtual server.
This removes the `myrule` iRule from the `my_virtual_server` virtual server.
Line 123: Line 133:
To view the logs generated by iRules, use the following command:
To view the logs generated by iRules, use the following command:


<nowiki>tail -f /var/log/ltm</nowiki>
<nowiki>
tail -f /var/log/ltm</nowiki>


This command will display the log entries created by iRules on the system.
This command will display the log entries created by iRules on the system.
Line 130: Line 141:
Before deploying an iRule, it is important to ensure that there are no syntax errors. To validate the syntax of an iRule, use:
Before deploying an iRule, it is important to ensure that there are no syntax errors. To validate the syntax of an iRule, use:


<nowiki>tmsh show ltm rule <iRule_name> syntax</nowiki>
<nowiki>
tmsh show ltm rule <iRule_name> syntax</nowiki>


Example:
Example:
<nowiki>tmsh show ltm rule myrule syntax</nowiki>
<nowiki>
tmsh show ltm rule myrule syntax</nowiki>


This command checks for syntax errors in the `myrule` iRule.
This command checks for syntax errors in the `myrule` iRule.
Line 140: Line 153:
For debugging iRules, use the **log** command to print debug messages to the system log. You can enable verbose logging to track the execution flow of the iRule:
For debugging iRules, use the **log** command to print debug messages to the system log. You can enable verbose logging to track the execution flow of the iRule:


<nowiki>log local0. "Debugging iRule execution: [HTTP::uri]"</nowiki>
<nowiki>
log local0. "Debugging iRule execution: [HTTP::uri]"</nowiki>


Additionally, you can use the following command to increase log verbosity:
Additionally, you can use the following command to increase log verbosity:


<nowiki>tmsh modify /sys log-config level debug</nowiki>
<nowiki>
tmsh modify /sys log-config level debug</nowiki>


This will increase the level of logging on the system, helping to debug any issues with iRule execution.
This will increase the level of logging on the system, helping to debug any issues with iRule execution.
Line 158: Line 173:
* [F5 iRules YouTube Channel](https://www.youtube.com/user/F5Networks)
* [F5 iRules YouTube Channel](https://www.youtube.com/user/F5Networks)


---
----


'''''[https://it-arts.net/index.php/Category:Wiki Return to Wiki Index]'''''
'''''[https://it-arts.net/index.php/Category:Wiki Return to Wiki Index]'''''

Latest revision as of 08:14, 18 February 2026


Return to Wiki Index

Viewing iRules

Viewing All iRules

To display all configured iRules, use the following command: 

tmsh show ltm rule

This command lists all iRules on the system along with their current status.

Viewing a Specific iRule

To view a specific iRule by name, use: 

tmsh show ltm rule <iRule_name>

Example: 

tmsh show ltm rule myrule

This command will display the full content of the `myrule` iRule.

Creating and Managing iRules

Creating a New iRule

To create a new iRule, use the following command: 

tmsh create ltm rule <iRule_name> { <iRule_script> }

Example: 

tmsh create ltm rule myrule { when HTTP_REQUEST { log local0. "Received HTTP request" } }

This creates an iRule named `myrule` that logs an entry for each HTTP request received.

Modifying an Existing iRule

To modify an existing iRule, use: 

tmsh modify ltm rule <iRule_name> { <new_iRule_script> }

Example: 

tmsh modify ltm rule myrule { when HTTP_REQUEST { log local0. "Received HTTP request with URI: [HTTP::uri]" } }

This modifies the `myrule` iRule to log the URI of each HTTP request.

Deleting an iRule

To delete an iRule, use: 

tmsh delete ltm rule <iRule_name>

Example: 

tmsh delete ltm rule myrule

This deletes the `myrule` iRule from the system.

iRule Syntax and Components

      1. Basic iRule Syntax

An iRule consists of **event blocks**, which trigger actions based on specific traffic events. The basic syntax of an iRule looks like this: 

when <event> {
    <action>
}

Example: 

when CLIENTSSL_HANDSHAKE {
    log local0. "SSL handshake initiated"
}
      1. Common Events in iRules

- **HTTP_REQUEST**: Triggered when an HTTP request is received. - **HTTP_RESPONSE**: Triggered when an HTTP response is generated. - **CLIENTSSL_HANDSHAKE**: Triggered during the SSL handshake. - **TCP_REQUEST**: Triggered for TCP traffic.

      1. Common Actions in iRules

- **log**: Logs information to the system log. - **reject**: Rejects the connection. - **forward**: Forwards the traffic to the next step. - **pool**: Directs the traffic to a specific pool or server.

      1. Example iRule for HTTP Request Logging
when HTTP_REQUEST {
    log local0. "Received HTTP request: [HTTP::uri]"
}

This iRule logs each HTTP request's URI to the system log.

Assigning iRules to Virtual Servers

To assign an iRule to a virtual server, use the following command: 

tmsh modify ltm virtual <vs_name> rules add { <iRule_name> }

Example: 

tmsh modify ltm virtual my_virtual_server rules add { myrule }

This command adds the `myrule` iRule to the `my_virtual_server` virtual server.

Removing an iRule from a Virtual Server

To remove an iRule from a virtual server, use: 

tmsh modify ltm virtual <vs_name> rules delete { <iRule_name> }

Example: 

tmsh modify ltm virtual my_virtual_server rules delete { myrule }

This removes the `myrule` iRule from the `my_virtual_server` virtual server.

Troubleshooting iRules

Viewing iRule Logs

To view the logs generated by iRules, use the following command: 

tail -f /var/log/ltm

This command will display the log entries created by iRules on the system.

Checking iRule Syntax

Before deploying an iRule, it is important to ensure that there are no syntax errors. To validate the syntax of an iRule, use: 

tmsh show ltm rule <iRule_name> syntax

Example: 

tmsh show ltm rule myrule syntax

This command checks for syntax errors in the `myrule` iRule.

Debugging iRules

For debugging iRules, use the **log** command to print debug messages to the system log. You can enable verbose logging to track the execution flow of the iRule: 

log local0. "Debugging iRule execution: [HTTP::uri]"

Additionally, you can use the following command to increase log verbosity: 

tmsh modify /sys log-config level debug

This will increase the level of logging on the system, helping to debug any issues with iRule execution.

Return to Wiki Index

Retrieved from "https://it-arts.net/index.php?title=F5_BIG-IP_-_iRules&oldid=1123"