How do I find the requests of a specific client IP in the logs?

Q: How do I find the requests of a specific client IP in the logs?

In the Logs & Tracking tab, the filter strip of the HTTP Logs, Debug Mode Logs and TCP Logs sources contains a Client IP card; when the relevant IP is selected from the card, the table narrows to that client's records. The same result is also obtained with the search box, with a regular expression search through the RegExp button, or with Column Search. Since filtering and search work only on fetched records, for old records the Line Limit is increased and Refresh is used. If the client is behind a CDN or a proxy and there is no Trusted Proxy profile, the proxy address appears in the logs; the X-Forwarded-For filter in Debug Mode Logs makes it possible to search by the real address.

Short answer

In the Logs & Tracking tab, the filter strip of the HTTP Logs, Debug Mode Logs and TCP Logs sources contains a Client IP card; when the relevant IP is selected from the card, the table narrows to that client's records (Filter). The same result is also obtained with the search box, with a regular expression search through the RegExp button, or with Column Search. Since filtering and search work only on fetched records, for old records the Line Limit is increased and Refresh is used. If the client is behind a CDN or a proxy and there is no Trusted Proxy profile, the proxy address appears in the logs; the X-Forwarded-For filter in Debug Mode Logs makes it possible to search by the real address (Debug Logs · Filter).

Problem: The Records of a Single Client Cannot Be Found

A user reports receiving an error, and only that user's requests are to be examined. In a busy vService, this client's requests need to be picked out among thousands of records.

Solution: Four Methods

The method is selected according to where the record is kept and whether the client comes to TR7 directly or through a proxy.

Your situation	Suitable method
Narrowing the log on the device by IP or IP range	Method 1: Client IP filter and search
The client is behind a CDN or a proxy	Method 2: Debug Mode Logs → X-Forwarded-For
Recording only that client's requests in detail	Method 3: Conditional Debug
A longer history than what is kept on the device	Method 4: Log server

Method 1: Client IP Filter and Search Recommended

How it works The filter card lists the client addresses in the fetched records; the table narrows according to the selected address. The search tools search the same records by free text, regular expression or column.
Where it is opened Left Monitor Panel → vService → Logs & Tracking
Requirement For HTTP logs and TCP logs, LOG must be on in the vService
vService type HTTP · L7 TCP

Step-by-Step Configuration

Adım 1 Open the vService edit form (if LOG is off)

On the Load Balancer → Load Balancer vService List screen, the vService is right-clicked and Edit is selected. If LOG is already on, steps 1–3 are skipped.

Adım 2 Check LOG

LOG is checked in the Details panel; the first saved Logs profile comes into the Log Profile field, or, if there is no profile at all, the built-in Stream Log. Stream log enables the logs on the device and does not send to a log server (how to add it to a vService).

Adım 3 Save

Save is clicked. Recording starts from the requests that arrive after this moment.

Adım 4 Open the vService screen

In the Left Monitor Panel, Load Balancer vServices is selected from the category selector and the vService is clicked (accessing the screen).

Adım 5 Open the Logs & Tracking tab

The Logs & Tracking tab is clicked.

Adım 6 Select the log source

HTTP Logs (in L7 TCP, TCP Logs) is selected from the source selector.

Adım 7 Increase the line limit (if the request being looked for is old)

The Line Limit value in the toolbar is increased (default 1000, at most 50000). There is no Line limit in TCP logs.

Adım 8 Fetch the records again

Refresh is clicked (Refresh); a Line limit change does not fetch the records again on its own.

Adım 9 Select the IP

In the filter strip, the Client IP card is opened and the address is selected; a search can be made inside the card and more than one address can be selected.

Adım 10 Search for a range (if needed)

For an IP range, the RegExp button next to the search box is turned on and, e.g., 198\.51\.100\. is typed; Column Search is used to limit the search to a single column.

Verification

1ResultTR7 side

The Connection info column of the records in the table is checked.

ExpectedOnly the selected IP

Method 2: Debug Mode Logs → X-Forwarded-For

How it works If there is a CDN or a proxy in front of TR7 and there is no Trusted Proxy profile, Client IP is the proxy address; the X-Forwarded-For filter filters by the real address in the request header.
Where it is opened Logs & Tracking → Debug Mode Logs → filter strip
Requirement HTTP vService with Debug mode on
vService type HTTP

Step-by-Step Configuration

Adım 1 Open the vService edit form

On the Load Balancer → Load Balancer vService List screen, the HTTP vService is right-clicked and Edit is selected.

Adım 2 Select Debug mode

Debug Mode is selected in the Status field, or Debug is checked in the Details panel.

Adım 3 Save

Save is clicked. Recording starts from the requests that arrive after this moment.

Adım 4 Open the vService screen

In the Left Monitor Panel, Load Balancer vServices is selected from the category selector and the vService is clicked.

Adım 5 Open the Logs & Tracking tab

The Logs & Tracking tab is clicked.

Adım 6 Select the Debug mode logs source

Debug Mode Logs is selected from the source selector; Refresh is used for requests that arrive later (Refresh).

Adım 7 Add the filter

The X-Forwarded-For filter, hidden by default, is added to the filter strip and the address is selected (Filter).

Adım 8 Open the edit form again

When the examination is finished, the vService is opened again with Edit.

Adım 9 Turn off Debug mode

Status = Enabled is selected; Debug mode does not turn off on its own.

Adım 10 Save

Save is clicked.

For the real address to appear as Client IP in all logs, a Trusted Proxy profile is assigned to the vService: There is a CDN such as Cloudflare / Akamai in front of TR7; how do I get the Real client IP (trusted proxy)?

Verification

1ResultTR7 side

After the filter is applied, the table is checked.

ExpectedOnly that client's requests

Method 3: Conditional Debug

How it works Debug records only the requests that match the condition; the 128 MB debug record budget is spent only on that client's requests.
Where it is opened vService → Details → Debug → condition field
Requirement HTTP vService; a Source IP condition that selects the client address
vService type HTTP

Step-by-Step Configuration

Adım 1 Open the condition form

The condition form is opened with Load Balancer → Conditions → Add (how to add).

Adım 2 Enter the client address

Criteria = Source IP and Source IP Type = Manual are selected, and the client address (e.g. 198.51.100.7) is entered.

Adım 3 Save the condition

Add in the form is clicked.

Adım 4 Open the vService edit form

On the Load Balancer → Load Balancer vService List screen, the HTTP vService is right-clicked and Edit is selected.

Adım 5 Turn on Debug with the condition

Debug is checked in the Details panel and this condition is selected in the condition field below it (conditional debug).

Adım 6 Save

Save is clicked. The records are seen in the Logs & Tracking → Debug Mode Logs source; when the examination is finished, Status is set back to Enabled and saved.

Verification

1ResultTR7 side

The Debug Mode Logs table is checked.

ExpectedOnly that client's requests

Method 4: Log Server

How it works Since the records on the device are limited by a size budget, a long history is searched in the lines sent with the log profile.
Where it is opened Log server or SIEM
Requirement A Logs profile with a log server address defined
vService type HTTP · L7 TCP

Step-by-Step Configuration

Adım 1 Set up the sending (if needed)

Sending the logs to the log server: How do I send logs to a SIEM (Syslog)?

Adım 2 Search

On the log server, a search is made in the client address field: ci in the network object in TR7 JSON Format, and the src field in CEF Format (TR7 JSON · network (Network Information)).

Verification

1Log serverExternal system

A search is made with the client address.

ExpectedLines belonging to that client

Common Mistakes

Increasing the line limit and not using Refresh. Filtering and search work only on fetched records; changing the Line limit does not fetch the records again on its own.
Assuming the proxy address behind a CDN is the real client. If there is no Trusted Proxy profile, all requests appear with the proxy address.
Searching with the full address while the IP log masking action is on. If IP Log Masking is on, the address is written to the logs masked (Can I mask IP addresses in the logs for KVKK / GDPR?).
Forgetting that an old record may have been deleted. The logs on the device are limited by a size budget (How long are logs kept on the device?).

How it is done in the documentation

How do I find the requests of a specific client IP in the logs? ​

Problem: The Records of a Single Client Cannot Be Found ​

Solution: Four Methods ​

Method 1: Client IP Filter and Search Recommended ​

Step-by-Step Configuration ​

Verification ​

Method 2: Debug Mode Logs → X-Forwarded-For ​

Step-by-Step Configuration ​

Verification ​

Method 3: Conditional Debug ​

Step-by-Step Configuration ​

Verification ​

Method 4: Log Server ​

Step-by-Step Configuration ​

Verification ​

Common Mistakes ​

How do I find the requests of a specific client IP in the logs?

Problem: The Records of a Single Client Cannot Be Found

Solution: Four Methods

Method 1: Client IP Filter and Search Recommended

Step-by-Step Configuration

Verification

Method 2: Debug Mode Logs → X-Forwarded-For

Step-by-Step Configuration

Verification

Method 3: Conditional Debug

Step-by-Step Configuration

Verification

Method 4: Log Server

Step-by-Step Configuration

Verification

Common Mistakes