BIG-IP : determine active device

Question

F5 BIG-IP Virtual Edition v11.4.1 (Build 635.0) LTM on ESXi&nbsp;
Via iControl API : &nbsp;
How to determine if a specific device is operating in active or standby mode for an active-standby sync-failover device-group ?  For a floating traffic-group ? &nbsp;
Alternately, for device-group or traffic-group , how to determine active device ?&nbsp;

hamish · Answer

Here's one from walkF5Stats that I wrote a few years back... There's some additional bits in there that track elapsed time to call, logging etc. but the important part is the call to System/Failover and get_failover_state
Now that's (below) only for a device. In v11 with traffic-groups it's slightly different. Hold on a bit and I'll see if I can dig that up (I wrote something a couple of months ago for that, just need to find it 🙂 )
sub getFailoverState {
  my ($dbh, $dev)=(@_);
  my $t0=[gettimeofday];

my $devID=$dev-&gt;{ID};
  my $devFQDN=$dev-&gt;{FQDN};
  my $icServer=$dev-&gt;{MgmtAddr};
  my $icPort=$dev-&gt;{MgmtPort};

dbprint "getFailoverState: cookiejar (Before)
";
  print Dumper($cookieJar);
  my $Failover =  SOAP::Lite
        -&gt; uri('urn:iControl:System/Failover')
        -&gt; proxy("$sProtocol://$icUser:$icPass\@$icServer:$icPort/iControl/iControlPortal.cgi", cookie_jar =&gt; $cookieJar);
        -&gt; proxy("$sProtocol://$icUser:$icPass\@$icServer:$icPort/iControl/iControlPortal.cgi"i,
  $Failover-&gt;transport-&gt;cookie_jar($cookieJar);

dbprint "getFailoverState: Getting failover state for $devFQDN
";

my $soapResponse = $Failover-&gt;get_failover_state();

dbprint "getFailoverState: cookiejar (After)
";
  print Dumper($cookieJar);

&amp;checkResponse($soapResponse);
  my $failoverState=$soapResponse-&gt;result;

dbprint "getFailoverState: state=$failoverState
";

my $updatestr="update device set fostate='$failoverState' where id=$devID";
  dbprint "getFailoverState: SQL [$updatestr]
";
  my $update=$dbh-&gt;prepare($updatestr);
  $update-&gt;execute;

my $elapsed=tv_interval ( $t0 );
  log_action($elapsed, 0, "getFailoverState", "$updatestr");

}

shaggy · Answer

I was able to get v11 failover-state using 'Management.DeviceGroup.get_failover_status()' (https://devcentral.f5.com/wiki/iControl.Management__DeviceGroup__get_failover_status.ashx)
Not sure what language you use, but the python commands are:
Python 2.7.6
Type "help", "copyright", "credits" or "license" for more information.
&gt;&gt;&gt; import bigsuds
&gt;&gt;&gt; import getpass
&gt;&gt;&gt; nameuse = raw_input('user: ')
user: admin
&gt;&gt;&gt; passuse = getpass.getpass()
Password: xxxxxxx
&gt;&gt;&gt; b1 = bigsuds.BIGIP(hostname = "lb-01.test.com",username = nameuse,password = passuse)
&gt;&gt;&gt; b2 = bigsuds.BIGIP(hostname = "lb-02.test.com",username = nameuse,password = passuse)
&gt;&gt;&gt; print b1.Management.DeviceGroup.get_failover_status()
{'failover_status': 'HA_STATE_STANDBY', 'color': 'COLOR_GRAY', 'status': 'STANDBY', 'details': [], 'summary': '1/1 standby'}
&gt;&gt;&gt; print b2.Management.DeviceGroup.get_failover_status()
{'failover_status': 'HA_STATE_ACTIVE', 'color': 'COLOR_GREEN', 'status': 'ACTIVE', 'details': ['active for /Common/traffic-group-1'], 'summary': '1/1 active'}

hamish · Answer

Hi shaggy.&nbsp;
That's the same call as above. But I'm not sure it has the detail that's required if you run many traffic-groups. Does the details change if you have 10 traffic-groups active for example?&nbsp;
There's another call in the v11 iControl that's gets the status of the traffic-group itself. Saves parsing out any comment that may or may not be the same in a few versions time.&nbsp;
Sorry, can't find my notes that I made from when I looked at this, but if you look in Management::TrafficGroup you should find what you need to determine where a traffic-group is currently living.&nbsp;

shaggy · Answer

Hi Hamish,
Your script uses System.Failover.get_failover_state() - https://devcentral.f5.com/wiki/iControl.System__Failover__get_failover_state.ashx. Calling that against my test HA pair (both units are active for different traffic-groups) shows:
&gt;&gt;&gt; print b1.System.Failover.get_failover_state()
FAILOVER_STATE_ACTIVE

&gt;&gt;&gt; print b2.System.Failover.get_failover_state()
FAILOVER_STATE_ACTIVE

When calling Management.DeviceGroup.get_failover_status(), output shows the failover status per device with more detail, such as all active traffic-groups on that device. For example, the same call with 10 traffic groups. 1-5 are active on lb-01 and 6-10 are active on lb-02:
&gt;&gt;&gt; print b1.Management.DeviceGroup.get_failover_status()
{'failover_status': 'HA_STATE_ACTIVE', 'color': 'COLOR_GREEN', 'status': 'ACTIVE', 'details': ['active for /Common/traffic-group-10', 'active for /Common/traffic-group-7', 'active for /Common/traffic-group-6', 'active for /Common/traffic-group-9', 'active for /Common/traffic-group-8'], 'summary': '5/10 active'}

&gt;&gt;&gt; print b2.Management.DeviceGroup.get_failover_status()
{'failover_status': 'HA_STATE_ACTIVE', 'color': 'COLOR_GREEN', 'status': 'ACTIVE', 'details': ['active for /Common/traffic-group-1', 'active for /Common/traffic-group-3', 'active for /Common/traffic-group-4', 'active for /Common/traffic-group-2', 'active for /Common/traffic-group-5'], 'summary': '5/10 active'}

I do not see anything that shows where a specified traffic-group is active - I was looking under Management.TrafficGroup (https://devcentral.f5.com/wiki/iControl.Management__TrafficGroup.ashx) but only saw calls for configuration details

hamish · Answer

Hmm... I'm sure I used to have a script that would show the state from the traffic-group POV... i.e. given a traffic group, find where it was active... &nbsp;
Let me see if I can dig one out... &nbsp;
H&nbsp;

Forum Discussion

BIG-IP : determine active device

8 Replies

SSO Login Update Coming to DevCentral

Kevin - June 2026 Featured F5er

Tyler - May 2026 Featured Member

Recent Discussions

ASM attack signatures not syncing between active and standby F5

Query on source IP preservation for syslog traffic through F5 virtual server

Hardware BIG-IP appliance reach EOSS, but the software version running on it not yet?

VPN Communication Error with F5 BIG-IP Edge Client

simultaneous disabling / enabling of all LTM objects

Related Content

F5 BIG-IP Zero Trust Access

Four Active/Active load balancing examples with F5 BIG-IP and Azure Load Balancer

Automating Certificate Management on F5 BIG-IP

Azure Active Directory and BIG-IP APM Integration

BIG-IP Geolocation Updates – Part 7