Problem Statement

F5 Distributed Cloud request logs currently do not provide a complete capture of all HTTP request headers. The req_headers field logs only a subset of request headers and is subject to a 2KB size limitation.

When the total size of request headers exceeds this limit, the platform truncates the logged header information and sets the x-volterra-truncated-hdr flag to true. As a result, customers lose visibility into critical request attributes that may be required for troubleshooting, security investigations, application debugging, and traffic analysis.

Current Limitation

• req_headers does not contain a full representation of all inbound HTTP request headers.

• Header logging is limited to approximately 2KB.

• Requests with larger header sets are truncated.

• The x-volterra-truncated-hdr=true flag indicates truncation but does not provide a mechanism to retrieve the omitted header data.

• Customers are unable to reliably validate all client-supplied headers, custom application headers, authentication tokens, cookies, or upstream proxy headers from the XC logs.

Business Impact

• Increased time spent troubleshooting intermittent application issues.

• Inability to perform complete root cause analysis using XC logs alone.

• Additional dependency on application-side logging and packet captures.

• Reduced effectiveness of Distributed Cloud as a centralized observability platform.

• Challenges investigating issues involving authentication, session handling, API integrations, custom headers, and HTTP 5XX errors.

Expected Outcome

Provide complete, non-truncated request header visibility within Distributed Cloud logs and exports, enabling customers to perform effective troubleshooting, security investigations, and traffic analysis directly from the platform without relying on external packet captures or application-side logging.