Forum Discussion

Nimbostratus

Apr 18, 2016

F5 BIG IP memory issues

Hi Friends, I am facing some memory related issues in my vCMP guest. It looks like BIG IP is dropping some connections and i believe it is because of tm.tcpmemorypressure db keys. [root@F5_Prod...

BIG-IP

devops

LTM

Hannes_Rapp_162
Apr 18, 2016
(Updated as of 17 Jan/2017 to correct an error in the initial answer)

Your first observation is what matters. You're just near the 80% threshold with your tmm/pagemem.

Consider using a custom memory-friendly FastL4 profile if you have apps that require long timeouts (i.e. 2 hours):

Idle timeout - Anything from 30 to 300 seconds Reset on Timeout - Disabled Loose Initiation - Enabled

That will allow F5 to remove a connection entry from the table once idle timeout is exceeded without potentially impacting the user session. Should the session resume after idle timeout is exceeded, F5 will (re)add connection record even in case of alien TCP/ACK packet - normally, without
Loose Initiation
, it would reply with TCP/RST, demanding a new handshake. Such a profile is not an option if you use AFM module as that software explicitly does not accept any alien TCP/ACK or TCP/PSH packets - "SYN must be seen" is a strict requirement there. Neither is such a profile an option in case of use of L7 iRules.

Alternatively, you can contact support for instructions to increase tmm/pagemem (not intended to be a directly adjustable variable). You can also increase thresholds of TCP memory pressure, effectively delaying the activation of adaptive reaper (instructions here: https://support.f5.com/csp/article/K16562)

Regards,

Hannes_Rapp_162

Nacreous

Apr 18, 2016

(Updated as of 17 Jan/2017 to correct an error in the initial answer)

Your first observation is what matters. You're just near the 80% threshold with your tmm/pagemem.

Consider using a custom memory-friendly FastL4 profile if you have apps that require long timeouts (i.e. 2 hours):

Idle timeout - Anything from 30 to 300 seconds
Reset on Timeout - Disabled
Loose Initiation - Enabled

That will allow F5 to remove a connection entry from the table once idle timeout is exceeded without potentially impacting the user session. Should the session resume after idle timeout is exceeded, F5 will (re)add connection record even in case of alien TCP/ACK packet - normally, without

Loose Initiation

, it would reply with TCP/RST, demanding a new handshake. Such a profile is not an option if you use AFM module as that software explicitly does not accept any alien TCP/ACK or TCP/PSH packets - "SYN must be seen" is a strict requirement there. Neither is such a profile an option in case of use of L7 iRules.

Alternatively, you can contact support for instructions to increase tmm/pagemem (not intended to be a directly adjustable variable). You can also increase thresholds of TCP memory pressure, effectively delaying the activation of adaptive reaper (instructions here: https://support.f5.com/csp/article/K16562)

Regards,