gistfile1.txt

when CLIENT_ACCEPTED { 
  # Open High Speed Logging handle to syslog_pool 
  set hsl [HSL::open -proto UDP -pool pool_syslog] 
  log local0. "Connection from [IP::client_addr]" 
}

when HTTP_REQUEST {
  HSL::send $hsl "$headr [HTTP::header $headr]"
  HTTP::collect [HTTP::header "Content-Length"]
}

when HTTP_REQUEST_DATA {
  set RequestData [HTTP::payload]
  log local0. $RequestData
  if {$RequestData contains "pSessionId"}{ 
    set pass1 [getfield $RequestData "pSessionId>" 2]
    log local0. "pass1 is $pass1"
    # Handle variants of sessionIds coming from AS400 
    switch -glob $pass1 { 
      "ROS-" { 
        set ROSpass [getfield $pass1 "<" 1]
        log local0. "ROSpass is $ROSpass"
        set pSessionId $ROSpass
      } 
      "" { 
        log local0. "Checking for pass1 again: $pass1" 
        set CDATApass [getfield $pass1 "CDATA[" 2] 
        log local0. "CDATApass is $CDATApass" 
        set CDATApass2 [getfield $CDATApass "]" 1]
        log local0. "CDATAPass2 is $CDATApass2"
        set pSessionId $CDATApass2 
      }
    }
    log local0. "pSessionId is $pSessionId" 
    # Persist on pSessionId for 3mins
    persist uie $pSessionId 180 
  } else { 
    log local0. "No pSessionId" set NOpSessionId 1 
  }
  # Log the body of the request
  HSL::send $hsl $RequestData
}

when HTTP_RESPONSE { 
  #Iterate and log response headers 
  foreach headr [HTTP::header names] { 
    HSL::send $hsl "$headr [HTTP::header $headr]"
  } 
  #Collect the response body
  HTTP::collect [HTTP::header "Content-Length"]
}

when HTTP_RESPONSE_DATA { 
  #Set the payload we captured to $ResponseData 
  set ResponseData [HTTP::payload] 
  # Not sure why you are not using high speed logging here
  log local0. $ResponseData
}