erros in ltm log

Question

Hi,&nbsp;
BigIp Version 10.x&nbsp;
I,ve everyday a lot of errors in the ltm log.&nbsp;
Errors like this:&nbsp;
May 30 19:22:59 local/tmm err tmm[5277]: 01220001:3: TCL error: ssl_client_rule   -      while executing "X509::subject $cert"&nbsp;
May 30 19:27:49 local/tmm err tmm[5277]: 01220001:3: TCL error: ssl_client_rule  -      while executing "X509::subject $cert"&nbsp;
May 30 19:28:25 local/tmm err tmm[5277]: 01220001:3: TCL error: ssl_client_rule  -      while executing "X509::subject $cert"&nbsp;
May 30 19:39:36 local/tmm err tmm[5277]: 01220001:3: TCL error: ssl_client_rule  -      while executing "X509::subject $cert"&nbsp;
May 30 20:26:54 local/tmm err tmm[5277]: 01220001:3: TCL error: ssl_client_rule  -      while executing "X509::subject $cert"&nbsp;
May 30 20:52:09 local/tmm err tmm[5277]: 01220001:3: TCL error: ssl_client_rule  -      while executing "X509::subject $cert"&nbsp;
May 30 20:52:10 local/tmm err tmm[5277]: 01220001:3: TCL error: ssl_client_rule  -      while executing "X509::subject $cert"&nbsp;
May 30 21:13:23 local/tmm err tmm[5277]: 01220001:3: TCL error: ssl_client_rule  -      while executing "X509::subject $cert"&nbsp;
May 30 21:13:38 local/tmm err tmm[5277]: 01220001:3: TCL error: ssl_client_rule  - wrong  args: should be "session lookup ssl  "     while executing "session lookup ssl [SSL::sessionid]"&nbsp;
May 30 21:15:23 local/tmm err tmm[5277]: 01220001:3: TCL error: ssl_client_rule   -      while executing "X509::subject $cert"&nbsp;
May 30 21:15:32 local/tmm err tmm[5277]: 01220001:3: TCL error: ssl_client_rule   - wrong  args: should be "session lookup ssl  "     while executing "session lookup ssl [SSL::sessionid]"&nbsp;
 &nbsp;
 &nbsp;
 &nbsp;
 &nbsp;
Irule used:&nbsp;
 &nbsp;

when CLIENTSSL_CLIENTCERT {&nbsp;
   set cert [SSL::cert 0]&nbsp;
   set status [X509::verify_cert_error_string [SSL::verify_result]]&nbsp;
   set subject [X509::subject $cert]&nbsp;
   set serial [X509::serial_number $cert]&nbsp;
   set values [list $cert $status $subject $serial]&nbsp;
   session add ssl [SSL::sessionid] $values 1800&nbsp;
}&nbsp;
when HTTP_REQUEST {&nbsp;
   set values [session lookup ssl [SSL::sessionid]]&nbsp;
   if { [lindex $values 1] equals "ok" } {"&nbsp;
      HTTP::header insert ClientSSL_subject [lindex $values 2]&nbsp;
      HTTP::header insert ClientSSL_serial [lindex $values 3]&nbsp;
      pool dakota&nbsp;
      HTTP::header remove "If-Modified-Since"&nbsp;

}  elseif { [lindex $values 1] equals "" } {&nbsp;
      HTTP::redirect "https://sslerro.xx.xx/errors/nocert.htm"&nbsp;
SSL::session invalidate&nbsp;
}  else {&nbsp;
      HTTP::redirect "https://sslerror.xx.xx/errors/cert_error.htm"&nbsp;
SSL::session invalidate&nbsp;
   }&nbsp;
}&nbsp;
 &nbsp;
I know something has changed within version 10 (https://support.f5.com/kb/en-us/products/big-ip_ltm/releasenotes/product/relnote_10_1_0_ltm.html)&nbsp;
SSL::cert iRule commands (CR116806)&nbsp;
 &nbsp;
Any ideas to avoid the errors in the ltml log?&nbsp;
 &nbsp;
Dirk&nbsp;
&nbsp;
&nbsp;
 &nbsp;

nitass · Answer

set status [X509::verify_cert_error_string [SSL::verify_result]]can you try to log this variable (e.g. log local0. "status = $status")?

dirk_laan_18877 · Answer

log local0. "ClientSSl_Client handshake status: $status"&nbsp;
May 31 15:25:57 local/tmm info tmm[5277]: Rule  ssl_client_rule : ClientSSl_Client handshake status: ok&nbsp;
 &nbsp;
 &nbsp;
 &nbsp;
I can simulate this error. &nbsp;
Jun  3 14:57:40 local/tmm err tmm[5277]: 01220001:3: TCL error:  ssl_client_rule  -      while executing "X509::subject $cert"&nbsp;
 &nbsp;
When the Virtual Server is requesting the client cert, instead of clicking OK, I click on cancel then the error is logged in ltm.&nbsp;
 &nbsp;
 &nbsp;
 &nbsp;

nitass · Answer

I can simulate this error. 
&nbsp;   
&nbsp; When the Virtual Server is requesting the client cert, instead of clicking OK I click on cancel.in that case, may we check number of certificate (i.e. SSL::cert count) before proceeding? 
&nbsp;  
&nbsp; SSL::cert wiki 
&nbsp; https://devcentral.f5.com/wiki/irules.SSL__cert.ashx

dirk_laan_18877 · Answer

Yes, I think this will cause no problems.&nbsp;

nitass · Answer

i think there are 2 errors. one is "while executing "X509::subject $cert" which can be avoid by checking SSL::cert count. 
&nbsp;  
&nbsp; the other one is "while executing session lookup ssl [SSL::sessionid]" which i understand SSL::sessionid returns null. in this case, you may also have to check if SSL::sessionid is null before preceeding. 
&nbsp;  
&nbsp; SSL::sessionid 
&nbsp;  
&nbsp; Returns the current connection's SSL session ID if it exists in the session cache.  
&nbsp; In version 10.x and higher, if the session ID does not exist in the cache, returns a null string. 
&nbsp; SSL::sessionid wiki 
&nbsp; https://devcentral.f5.com/wiki/irules.ssl__sessionid.ashx

Forum Discussion

erros in ltm log

7 Replies

Win Big in Vegas: The iRules Contest is back with $5k on the line at AppWorld 2026

Jürgen - February 2026 Featured Member

F5 Architecture Track Sessions - AppWorld 2026

Recent Discussions

GIS app loading very slow through F5 LTM

HTTP2 iRule manipulation

Apmd memory and swap grows over time

ASM bd daemon crash while processing request body (SIGSEGV) – anyone seen similar behavior?

F5 APM irule to log the VPN session parameters

Related Content

Forwarding Logs to SIEM Tools via HTTP Proxy for F5 Distributed Cloud Global Log Receiver

suppressed messages in ltm log

F5 Distributed Cloud Telemetry (Logs) - Loki

Log Http Headers

Logging DNS Requests

ABOUT DEVCENTRAL

RESOURCES

SUPPORT

PARTNERS