Manual Chapter : Creating Reports using PEM

Applies To:

Show Versions Show Versions

BIG-IP PEM

  • 11.5.10, 11.5.9, 11.5.8, 11.5.7, 11.5.6, 11.5.5, 11.5.4, 11.5.3, 11.5.2, 11.5.1
Manual Chapter

Overview: Creating reports using PEM

You can view logs of the traffic passing through the BIG-IP system using the reporting feature in Policy Enforcement Manager (PEM).

The logs can be either session-based or flow-based. Session-based logs provide information about the session, while flow-based logs contain information about the traffic flow.

In Policy Enforcement Manager, reporting provides a default format. The default format can be changed by defining a format script, which enables you to add your own text and fields, and customize the log messages you would like to see in the logging server.

For example, you can create a format script for session reporting by typing: return "(session bytes-in:[PEM::session stats reported bytes-in]). The iRules command retrieves the value of the attribute, bytes-in, in session record.

Similarly, you can create a format script for flow reporting by typing: return "(flow bytes-in:[PEM::flow stats reported bytes-in]). The iRules command retrieves the value of the attribute, bytes-in, in flow record.

Creating format scripts for reports

In an enforcement policy, format scripts can be defined for formatting report messages.
  1. On the Main tab, click Policy Enforcement > Reporting.
  2. Click Create. The Format Scripts screen opens.
  3. In the Name field, type a name for the custom format script.
  4. In the Description field, type a description of the format script.
  5. In the Definition field, specify the format script that defines the log messages you want. return "(session bytes-in:[PEM::session stats reported bytes-in], bytes-out:[PEM::session stats reported bytes-out], subs-id:[PEM::session stats reported subs-id], subs-id-type:[PEM::session stats reported subs-id-type], param-3gpp:[PEM::session stats reported param-3gpp], app-id:[PEM::session stats reported app-id], last-sent-sec:[PEM::session stats reported last-sent-sec],[PEM::session stats reported last-sent-usec], flows-concurrent:[PEM::session stats reported flows-concurrent], flows-new:[PEM::session stats reported flows-new], flows-ended:[PEM::session stats reported flows-ended], flows-duration:[PEM::session stats reported flows-duration], rec-reason:[PEM::session stats report rec-reason])" The iRule expression is in square brackets. You can select the Wrap Text check box to wrap the definition text, and select the Extend Text Area check box to increase the field space of format scripts.
  6. Click Update to save any changes.
  7. To attach to an HSL endpoint, follow the steps:
    1. Click Policy Enforcement > Policies.
    2. Select a policy name.
    3. Click a policy rule.
    4. From the Reporting list, select Enabled.
  8. From the Report Granularity list, select the appropriate option:
    • To log details about subscribers and application sessions, select Session.
    • For more granular reporting of every TCP connection, select Flow.
  9. In the Volume Threshold field, specify, in octets, the amount of data to receive from the client, send to the client, and the total traffic volume before logging the information.
  10. In the Destination setting, for HSL, select the HSL endpoint and then select the format script that you created in Policy Enforcement > Reporting.
  11. Click Finished.
You have created a reporting format script that enables you to customize the reporting string to any format.