You can collect L7 records to store on your Explore appliance, which show details
from individual messages or transactions over L7 protocols. These types of records require
triggers.
In the following example, you will learn how to collect records for any device that
sends or receives an HTTP response. First, we will write a trigger to collect
information from the built-in HTTP record type. Then, we will assign the trigger to a
web server. Finally, we will verify that the records are being sent to the Explore appliance.
-
Log into the Web UI on your Discover appliance.
-
Click the System Settings icon
, and then click Triggers.
-
Click New to launch the Trigger Configuration
window.
-
In the Configuration tab, complete your information,
similar to the following example:
Name:
HTTP Responses
Author:
ExtraHop
Description:
This trigger collects HTTP responses.
Debugging:
Select the checkbox to enable debugging.
Events:
HTTP_RESPONSE
-
Click the Editor tab.
-
Type the following example code in the text box:
HTTP.commitRecord()
debug ("committing HTTP responses")
This code generates records for the HTTP record type when the
HTTP_RESPONSE event occurs and corresponds to the
built-in record format for HTTP.
-
Click Save and Close. Next, assign this trigger to a web
server.
-
Click Metrics from the top menu and then click
Devices in the left pane.
-
Search for an active web server that you want to collect records for. For this
example, we will select a web server called web-sea-example.
-
Select the checkbox next to the web server (such as
web-sea-example).
-
Click Assign Trigger from the menu above the table.
-
From the list, select the checkbox next to the trigger we previously created
named HTTP Responses, and then click Assign Triggers.
Records that meet your criteria are now sent to your connected Explore appliance. Wait a few
minutes for records to be collected, and then verify that your records are being
collected in the next step.
-
Click Records from the top menu to launch a query. If
you do not see any HTTP records, wait a few minutes and try again. If no records
appear after five minutes, review your configuration or contact ExtraHop
Support.
Thank you for your feedback. Can we contact you to ask follow up questions?