For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Femi_132696's avatar
Femi_132696
Icon for Nimbostratus rankNimbostratus
Jul 30, 2015

Debugging Health Monitor - Node being randomly marked down and then up.

Hi,

 

I have a strange situation where 2 nodes in a pool are being randomly marked down and then up. But the server logs show no evidence that there were any errors.

 

The monitor URL always returns a 200 status code. Can you please give me clues for debugging this behaviour?

 

6 Replies

  • ![Image Text](/Portals/0/Users/088/96/132696/bigip_monitor.png)

     

    Hi Thanks for responding to me. I have inserted two images showing the configuration of the monitor and its usage.

     

    Thanks for your help. The access logs file don't show any problems with the monitored web-asset, there is always 200 OK response.

     

  • Hi Kevin,

     

    Your views on the config (screenshots) which I sent through would be very much appreciated.

     

    James

     

  • Hi,

     

    Please can anyone help me with this issue. Screenshot showing monitor config in the message trail.

     

    thanks

     

  • So is this unencrypted traffic on the server side of the BIG-IP? If it is, your best first step is to do a wire capture to look at the request and response traffic:

    tcpdump -lnni [server side vlan name] -Xs0 port [web server port] and host [web server IP]
    

    Without any application traffic going to the VIP, you should see the monitor traffic coming from the BIG-IP self-IP. You're then looking for what the request looks like and what the response looks like. You also stated that you always receive a 200 response. How are you testing when you see this response?

  • Thanks Kevin,

     

    I am tailing the access log files for the server, I could see request from the monitor returning a 200 response. But every so often, there was a http 0 status.

     

    I also noted that the monitor requests are using HTTP/0.9. I will update it to HTTP/1.1 after seeing the document below.

     

    https://support.f5.com/kb/en-us/solutions/public/3000/200/sol3224.htmlhttp : suggests that When an HTTP 0.9 request is sent to an HTTP 1.1 server, the server may not respond as expected.

     

    Hopefully that will help.