exchange logging irule

exchange_logging_irule

when HTTP_REQUEST priority 100 {
  switch -glob -- [string tolower [HTTP::path]] { 
    "/ews*" {
      if { [HTTP::header exists "User-Agent"] } {
          log local0. "EWS traffic,[IP::client_addr],[HTTP::header User-Agent]"
      } else {
          log local0. "EWS traffic,[IP::client_addr],No User-Agent"
      }
      if { [HTTP::header exists "Authorization"] } {
          log local0. "EWS traffic,[IP::client_addr],Authorization Header"
      }
      if { [HTTP::cookie exists "exchangecookie"] } {
          log local0. "EWS traffic,[IP::client_addr],[HTTP::cookie exchangecookie]"
      }
    }
    default {
      return
    }
  }
}