For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

sterreta_87927's avatar
sterreta_87927
Icon for Nimbostratus rankNimbostratus
May 19, 2014

Custom HTTP Monitor

Hello, I need to create a custom HTTP monitor and I have no scripting experience. The F5 LTM I am using is version is 10.2.4. This is what I started with:

 

I created the following send string to access URL: http://epictest.xxxxx.com/fdrd/component/login

 

GET /fdrd/component/login HTTP/1.1\r\nHost: ourhost.domain.com/\r\nConnection: Close\r\n\r\n

 

The receive string I want to match against is: "EPIC LOGIN" "EPIC 2.0"

 

That data is wrapped in Java and I do not know how to call it out in the receive string dialog. Here is the java script data from a Fiddler capture (Textview)(snapshot attached):

 

 

Any help at all is greatly appreciated.

 

Regards, Tony Sterrett

 

application delivery
availability
LTM
management
performance

4 Replies

  • mimlo_61970's avatar
    mimlo_61970
    Icon for Cumulonimbus rankCumulonimbus
    May 19, 2014

    You can use a regular expression, but it might not work exactly as you plan.

    EPIC Login.*EPIC.*2\.0

    This will match 'EPIC Login' followed by any amount of text, followed by 'EPIC' followed by any amount of text, finishing up with matching '2.0'

    The problem might be these matches occur anywhere in the document, and not necessarily in the fields you want them to. I think it would be pretty difficult to match the text as it appears on screen, without using the entire code block as the receive string.

    • sterreta_87927's avatar
      sterreta_87927
      Icon for Nimbostratus rankNimbostratus
      May 19, 2014
      Thank you. I have tried to find more specific entries that occur individually with in the response field, but I have had little luck thus far. I will try this out. Much appreciated.
    • sterreta_87927's avatar
      sterreta_87927
      Icon for Nimbostratus rankNimbostratus
      May 29, 2014
      I tried all of the following variations, but none of them worked: Epic Login.*EPIC.*2\.0 Epic Login.*EPIC Epic Login EPIC Login I am now trying to match the response Header "HTTP/1.1 200 OK". So far I have tried the following without success: HTTP/1.1.*200.*OK HTTP.*200.*OK 200.*OK 200 OK 200 The only string that has succeded in NOT marking the servers DOWN is "HTTP" (without the quotes), but that is too generic, as each Response Header starts with HTTP. Any help at all with coding the receive string for this monitor is greatly appreciated.
  • JG's avatar
    JG
    Icon for Cumulonimbus rankCumulonimbus
    May 29, 2014

    I think you have a problem here:

    GET /fdrd/component/login HTTP/1.1\r\nHost: ourhost.domain.com/\r\nConnection: Close\r\n\r\n

    This should not get you to the correct HTTP virtual server on the backend server for the extra "/" at the end of the "Host:" header.

    It is highly unlikely that "200 OK" isn't matched by the monitor if you do get to the correct HTTP server and the correct HTML page that returns the expected content (or indeed any content in that page).