Request Logging

Use this page to store detailed logs of the requests handled by your virtual server. You can write the logs to a local file on your Virtual Traffic Manager or to a syslog daemon running on a remote machine, according to the protocol described in RFC 5424. You can enable request logging for a virtual server by clicking the Request Logging link on the appropriate Virtual Servers > Edit page.

You can set the default logging behavior using the log!save_all setting. Set to “Yes” to instruct the Virtual Traffic Manager to log all connections by default. You can then use the TrafficScript function requestlog.exclude() inside a rule to exclude specific connections from the log. Set to “No” to instruct the Virtual Traffic Manager to not log connections by default. You can then use the TrafficScript function requestlog.include() in a rule to select specific connections to be included in the log. Click Update to apply your settings.

Request Logging to a File

You can specify a filename and log entry format, with details such as the IP addresses involved, the pool and node involved, and the bytes sent and received. You can also set HTTP-specific options such as the URL requested, the value of a specified header, and the HTTP method.

Unlike other logs, request logs are not synchronized across your cluster. Each Virtual Traffic Manager maintains its own log files.

To log requests to a file, set log!enabled to “Yes” and specify the filename for the log. Click Update to apply your settings.

Logs can be automatically rotated so that each log does not grow too large. Use a %t macro in the filename; this macro expands to the current time or date.

For example, the macro %{%Y%m%d}t expands to a value like 20161020 (for October 20, 2016). This will cause the log files to be automatically rotated at midnight as the value of the macro changes.

On virtual appliance and cloud instances of the Virtual Traffic Manager, log file naming and rotation is handled automatically:

The log files are checked hourly.

Any file that reaches 1 GB is archived.

After the cumulative size of all current log files reaches 6 GB, the largest logs are archived by decreasing size until the cumulative total drops below 6 GB.

All remaining logs are archived daily.

After the log directory reaches 85% of capacity, the Virtual Traffic Manager starts to delete the oldest files from the largest directories.

Viewing Request Logs

You can view request logs in real time by clicking the View Request Logs link. This redirects to the Activity > View Logs page, described in more detail in the Activity > View Logs.

Remote Request Logging

The Virtual Traffic Manager can log requests to a remote syslog server, rather than to a file on a local disk. All Virtual Traffic Managers in the same cluster log traffic to the same syslog server.

To configure remote logging, set syslog!enabled to “Yes”, specify an endpoint (IP address or host, and optional port), and select the log file format you want to use. Click Update to apply your settings.

The syslog protocol uses UDP, which is not guaranteed to be reliable. When traffic levels are particularly high on a busy or lossy network, there is the danger of log records being dropped.

Controlling Request Logging

Requests can be selectively logged. The TrafficScript function request.setLogEnabled() can be used to enable or disable logging for an individual request; if it enables logging, the settings in the Request Logging page are used to determine how the request is then logged (local log file or remote syslog server).