For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

DGordon's avatar
DGordon
Icon for Nimbostratus rankNimbostratus
Jun 13, 2007

Active Connection Counting

Hi everyone,

 

 

I have a pool that can currently only handle about 600 active connections. What I would like to do is use an iRule to monitor the active connections (as can be viewed in real time in the Pool Statistics), however searching on this forum I have found that this was not possible. That response was given over a year ago. Is this still the case?

 

 

I have been experimenting with the code sample located here:

 

 

http://devcentral.f5.com/wiki/default.aspx/iRules/HTTPSessionLimit.html

 

 

However I am seeing erratic behaviour if a user has cookies disabled (the active connections counter can increase by about 20 for a single page impression), in addition to the CLIENT_CLOSE being called before all requests have finished.

 

 

Does anyone have any alternative or better solutions for dynamically keeping track of current active connections and subsequently imposing redirects? Even External health monitors through some scripting and the like if anyone has explored that possibility.

 

 

Thanks in advance!
application delivery
dev
devops
iRules

1 Reply

  • DGordon's avatar
    DGordon
    Icon for Nimbostratus rankNimbostratus
    Jun 15, 2007
    Nobody seems to have any other ideas, so i'll share my new solution... 😄

    What it does is compares the number of current connections for a pool against a connection limit and, if it is exceeded, disables all pool members so that any new connections are redirected to a sorry page (configured in the profile). Existing and persistent connections are allowed to continue using the application. When the number of connections falls below the limit again, all pool members are switched back to active to allow new connections.

    I've used a health monitor instead of an iRule, using 4 variables configured through the Management GUI:

    
virtualServerName - The name of the virtual server you want to monitor.
poolName          - The name of the pool you want to monitor.
poolMembers       - Names of pool members separated by a space.
memberLimit       - The number of connections each member (specified above)
                    can accept, separated by a space.

    poolMembers
    and 
    memberLimit
    are converted to an array in the script.

    The health monitor is an External monitor comprising of the following:

    
!/bin/sh
poolConnGrab=`bigpipe virtual ${virtualServerName} | grep conns | head -1`
currConns=`expr "$poolConnGrab" : '[^0-9]*\([0-9]*\)'`
connLimit=0
limitCount=0
memberLimit=(${memberLimit})
for poolMember in ${poolMembers}
do
  logger "Pool Member ${poolMember}"
  
  if bigpipe virtual ${virtualServerName} | grep ${poolMember} | grep -q "UP"
    then
      logger "Server Is Up. Increasing Connection Limit."
      connLimit=`expr $connLimit + ${memberLimit[${limitCount}]}`
    else
      logger "Server is Down!"
  fi
  limitCount=`expr $limitCount + 1`
done
logger "Utilisation: ${currConns} of ${connLimit}"
if [ $currConns -lt $connLimit ]
  then
    logger "Connections ACCEPTABLE"
    for poolMember in ${poolMembers}
    do
        bigpipe pool ${poolName} member ${poolMember} session enable
    done
else
    logger "Connections UNACCEPTABLE"
    for poolMember in ${poolMembers}
    do
        bigpipe pool ${poolName} member ${poolMember} session disable
    done
fi
echo "up"
exit 0

    This works quite well for a global connection limit on a pool, and then using a ratio algorithm on the pool members. This script logs to /var/log/messages.

    There's still room for improvement (like detecting if a member is already, for example, disabled and, if so, don't bother running the command again to disable it).