Personally i use a combination of ADM and custom message actions
e
Eirik Vesterhus / Intility AS
03/11/2021, 4:06 PM
Cool. Which parts of the request are you dumping to syslog with custom message actions? I have experimented with this before and if I dump the body it can make the VPX throw a fit if it is too big.
m
Mads Petersen
03/11/2021, 4:42 PM
I very seldom drop any part of the body, mostly headers/client IP/requests hostname/URL and service.
If my customers (I don't really manage ADCs in a day-to-day scenario) wanted information from the body, i would figure out what their requirements was and how to limit it, as i don't think dumping a full body on the ADC the correct place to do that.
e
Eirik Vesterhus / Intility AS
03/17/2021, 2:09 PM
Thanks. I agree on the body part. My requirement is to log everything from everything, so it needs to scale well. With that in mind I do not think custom message actions / syslog (even without body) is the way forward. Guess I will set up NSWL and check it out.