For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

goldi_247196's avatar
goldi_247196
Icon for Nimbostratus rankNimbostratus
Jun 21, 2016

F5 iRule for UIE - latency on using the persist uie command

we are trying to introduce to our service the F5 load balancer and in order to do that we are developing an iRule that persist session with the universal persistence feature. but when trying to persist session with the iRule command "persist uie" we are experiencing latency. the latency can get more then 1000ms... what seems to be the problem? how can we get rid of this latency ??

 

please see our iRule code and the logs that we recorded. thanks in advance

 

here is our iRule code:

 

when HTTP_REQUEST {
                if {[HTTP::host] equals "mpi-lb.creditguard.co.il" } {
                                set txID1 ""
                                set txID2 ""
                                set txID3 ""
                                set txID4 ""
                                set txID5 ""
                                set txID6 ""
                                set txID7 ""
                                set txID8 ""
                                 Log details for the request
                                regexp {(txId|token|mpiTransactionId|transactionID)[=>]([0-9a-z]{8}-([0-9a-z]{4}-){3}[0-9a-z]{12})([&< ]|$)} [HTTP::uri] => txID1 txID2 txID3 txID4
                                regexp {(txId|token|mpiTransactionId|transactionID)[=>]([0-9a-z]{8}-([0-9a-z]{4}-){3}[0-9a-z]{12})([&< ]|$)} [HTTP::payload] => txID5 txID6 txID7 txID8
                                log local0. "uri:[HTTP::uri]:payload: txID2:$txID2 txID6:$txID6"
                                if {$txID2 != ""} {
                                                log local0. "persist lookup uie:[persist lookup uie $txID2] $txID2 in uri"
                                                **persist uie** $txID2
                                } elseif {$txID6 != ""} {
                                                log local0. "persist lookup uie:[persist lookup uie $txID6] $txID6 in paylod"
                                                persist uie $txID6
                                }
                }
}

when HTTP_RESPONSE {
                if {([IP::server_addr] equals "172.16.100.16") || ([IP::server_addr] equals "172.16.100.17") } {
                                 Trigger collection for up to 1MB of data
                                if {[HTTP::header exists "Content-Length"] && [HTTP::header "Content-Length"] <= 1048576} {
                                                set content_length [HTTP::header "Content-Length"]
                                } else {
                                                set content_length 1048576
                                }
                                 Check if $content_length is not set to 0
                                if { ([HTTP::status] == 200) && ($content_length > 0)} {
                                                HTTP::collect $content_length
                                }
                }
}

when HTTP_RESPONSE_DATA {
                if {([IP::server_addr] equals "172.16.100.16") || ([IP::server_addr] equals "172.16.100.17") } {
                                 do stuff with the payload
                                find the application unique identifier between  and  (5 is the length of  string)
                                set txId [string trim [findstr [HTTP::payload] "" 5 ""] ">"]
                                if {$txId != ""} {
                                                log local0. "[IP::server_addr] : persist add uie $txId"
                                                persist add uie $txId 1800
                                }
                }
}

here are the logs (you can see the latency between 14:16:08 and 14:17:08)

 

Tue Jun 14 14:16:03 IDT 2016  info  cgwaf tmm3[10326]    Rule /Common/mpi-lb-irule : uri://CGMPI_Server/CreateTransactionExtended:payload: txID2: txID6:  
Tue Jun 14 14:16:04 IDT 2016 info cgwaf  tmm3[10326]     Rule /Common/mpi-lb-irule : 172.16.100.16 : persist add uie 03f72209-754e-4bde-85f6-69cdf4d27526  
Tue Jun 14 14:16:08 IDT 2016  info cgwaf tmm1[10326]     Rule /Common/mpi-lb-irule : uri://CGMPI_Server/PerformTransaction? txId=03f72209-754e-4bde-85f6-69cdf4d27526:payload: txID2:03f72209-754e-4bde-85f6-69cdf4d27526 txID6:  
Tue Jun 14 **14:16:08** IDT 2016  info cgwaf tmm1[10326]     Rule /Common/mpi-lb-irule : persist lookup uie:/Common/mpi-lb 172.16.100.16 443 03f72209-754e-4bde-85f6-69cdf4d27526 in uri 
Tue Jun 14 **14:17:08** IDT 2016  info cgwaf tmm2[10326]     Rule /Common/mpi-lb-irule : uri://CGMPI_Server/merchantPages/ResponsiveWebSources/images/cvv.jpg:payload: txID2: txID6:  
Tue Jun 14 14:17:08 IDT 2016  info  cgwaf tmm[10326]    Rule /Common/mpi-lb-irule : uri://CGMPI_Server/merchantPages/ResponsiveWebSources/images/mastercard_slice.gif:payload: txID2: txID6:  
Tue Jun 14 14:17:08 IDT 2016  info cgwaf tmm[10326]     Rule /Common/mpi-lb-irule : uri://CGMPI_Server/merchantPages/ResponsiveWebSources/images/pci_slice.gif:payload: txID2: txID6:  
Tue Jun 14 14:17:08 IDT 2016  info cgwaf tmm[10326]     Rule /Common/mpi-lb-irule : uri://CGMPI_Server/merchantPages/ResponsiveWebSources/images/visa_slice.gif:payload: txID2: txID6:  
Tue Jun 14 14:17:08 IDT 2016  info cgwaf tmm[10326]     Rule /Common/mpi-lb-irule : uri://CGMPI_Server/merchantPages/ResponsiveWebSources/images/Logo.gif:payload: txID2: txID6:  
Tue Jun 14 14:17:08 IDT 2016  info  cgwaf tmm3[10326]    Rule /Common/mpi-lb-irule : uri://CGMPI_Server/merchantPages/ResponsiveWebSources/images/qm.png:payload: txID2: txID6:  
Tue Jun 14 14:18:06 IDT 2016  info  cgwaf tmm2[10326]    Rule /Common/mpi-lb-irule : uri://CGMPI_Server/ProcessCreditCard:payload: txID2: txID6:03f72209-754e-4bde-85f6-69cdf4d27526  
Tue Jun 14 14:18:06 IDT 2016  info cgwaf tmm2[10326]     Rule /Common/mpi-lb-irule : persist lookup uie:/Common/mpi-lb 172.16.100.16 443 03f72209-754e-4bde-85f6-69cdf4d27526 in paylod  
Tue Jun 14 14:18:07 IDT 2016  info cgwaf tmm2[10326]     Rule /Common/mpi-lb-irule : uri:/CGMPI_Server/merchantPages/nlb/OK.jsp?uniqueID=697536646.622257&lang=EN&authNumber=9125242& responseMac=7e77d7fe857e707ddf1c8990c80da8373f716c79d0ee79b88 f3d898a9ff0afc0&cardToken=1051484189394580& cardExp=0217&personalId=88888888& cardMask=458045******4580& txId=03f72209-754e-4bde-85f6-69cdf4d27526& numberOfPayments=&firstPayment=&periodicalPayment=:payload: txID2:03f72209-754e-4bde-85f6-69cdf4d27526 txID6:  
Tue Jun 14 14:18:07 IDT 2016  info cgwaf tmm2[10326]     Rule /Common/mpi-lb-irule : persist lookup uie:/Common/mpi-lb 172.16.100.16 443 03f72209-754e-4bde-85f6-69cdf4d27526 in uri 
Tue Jun 14 14:18:07 IDT 2016  info cgwaf tmm2[10326]     Rule /Common/mpi-lb-irule : uri:/CGMPI_Server/merchantPages/WebSources/images/ssl.png:payload: txID2: txID6:
application delivery
BIG-IP
iRules

10 Replies

  • Yann_Desmarest's avatar
    Yann_Desmarest
    Icon for Cirrus rankCirrus
    Jun 21, 2016

    Hi,

     

    You have several part that can cause latency : regexp, http payload collection, string manipulation.

     

    You can try disabling each one at the time to check which part of your irule can cause latency.

     

    Try removing the HTTP::collect and HTTP_RESPONSE_DATA to start. I think that it may be your issue.

     

    • goldi_247196's avatar
      goldi_247196
      Icon for Nimbostratus rankNimbostratus
      Jun 21, 2016
      thanks, for the quick answer and we will use the timing command. also we are aware of the regexp and we plan to move the "txId" to the headers. but if I'm not mistaken we are experiencing the latency after the regexp command has been completed and more accurately the latency is being viewed when executing the "persist uie" command. does this make sense...?
    • Yann_Desmarest's avatar
      Yann_Desmarest
      Icon for Cirrus rankCirrus
      Jun 21, 2016
      I never had see any latency on universal persistence. But basically, I assume that extra long string used as persistence records along with big connection table may impact performance.
  • Yann_Desmarest_'s avatar
    Yann_Desmarest_
    Icon for Nacreous rankNacreous
    Jun 21, 2016

    Hi,

     

    You have several part that can cause latency : regexp, http payload collection, string manipulation.

     

    You can try disabling each one at the time to check which part of your irule can cause latency.

     

    Try removing the HTTP::collect and HTTP_RESPONSE_DATA to start. I think that it may be your issue.

     

    • goldi_247196's avatar
      goldi_247196
      Icon for Nimbostratus rankNimbostratus
      Jun 21, 2016
      thanks, for the quick answer and we will use the timing command. also we are aware of the regexp and we plan to move the "txId" to the headers. but if I'm not mistaken we are experiencing the latency after the regexp command has been completed and more accurately the latency is being viewed when executing the "persist uie" command. does this make sense...?
    • Yann_Desmarest_'s avatar
      Yann_Desmarest_
      Icon for Nacreous rankNacreous
      Jun 21, 2016
      I never had see any latency on universal persistence. But basically, I assume that extra long string used as persistence records along with big connection table may impact performance.
  • Yann_Desmarest_'s avatar
    Yann_Desmarest_
    Icon for Nacreous rankNacreous
    Jun 21, 2016

    When launching the following command in tmsh : 

    show /ltm persistence persist-records

    How many records do you get ? and what is the typical length of a persistence record ?

    • goldi_247196's avatar
      goldi_247196
      Icon for Nimbostratus rankNimbostratus
      Jun 21, 2016
      thanks,I'll check and I'll update you This is the result I got: yonin@(cgwaf)(cfg-sync Changes Pending)(Active)(/Common)(tmos) yonin@(cgwaf)(cfg-sync Changes Pending)(Active)(/Common)(tmos) show /ltm persistence persist-records Sys::Persistent Connections universal 256d27e9-0180-40c5-81c6-5dcc09b21f1c 172.16.100.113:443 172.16.100.17:443 (tmm: 3) universal 256d27e9-0180-40c5-81c6-5dcc09b21f1c 172.16.100.113:443 172.16.100.17:443 (tmm: 1) Total records returned: 2 sometimes return 3 records
  • Yann_Desmarest's avatar
    Yann_Desmarest
    Icon for Cirrus rankCirrus
    Jun 21, 2016

    When launching the following command in tmsh : 

    show /ltm persistence persist-records

    How many records do you get ? and what is the typical length of a persistence record ?

    • goldi_247196's avatar
      goldi_247196
      Icon for Nimbostratus rankNimbostratus
      Jun 21, 2016
      thanks,I'll check and I'll update you This is the result I got: yonin@(cgwaf)(cfg-sync Changes Pending)(Active)(/Common)(tmos) yonin@(cgwaf)(cfg-sync Changes Pending)(Active)(/Common)(tmos) show /ltm persistence persist-records Sys::Persistent Connections universal 256d27e9-0180-40c5-81c6-5dcc09b21f1c 172.16.100.113:443 172.16.100.17:443 (tmm: 3) universal 256d27e9-0180-40c5-81c6-5dcc09b21f1c 172.16.100.113:443 172.16.100.17:443 (tmm: 1) Total records returned: 2 sometimes return 3 records