F5 Pool Members flapping issue

It will be interesting to check the tcp dump. can you run a tcp dump on F5 by running tcpdum -ni "vlan/interface" dst host 10.64.32.16 and src host "F5 self IP" -w . It seems like tcp health check's timeout is expiring before server responds. But then again maybe I am stating the obvious. Are the timers on tcp health check default? or were they fine tuned at any stage?

deleted

Hi Buddy, Your destination port in tcp dump is always changing. What is the port number on which pool members of this pool are listening? Can you run following commands from tmsh and provide the input 1) list /ltm monitor tcp 2) list /ltm pool "pool_name" I am assuming that you are using tcp monitor for your health check, but if you are using some other health check please change its name instead of tcp.

Hi bro, yes im using TCP for monitor, is it wrong?

ravi@(F5_1-PRD-Tibco)(cfg-sync In Sync)(Active)(/Common)(tmos) list /ltm monitor tcp
ltm monitor tcp tcp {
    destination *:*
    interval 5
    time-until-up 0
    timeout 16
}
ltm monitor tcp tcp_7456 {
    defaults-from tcp
    destination *:*
    interval 5
    time-until-up 0
    timeout 16
}
ltm monitor tcp tcp_8081 {
    defaults-from tcp
    destination *.tproxy
    interval 5
    time-until-up 0
    timeout 16
}
ltm monitor tcp tcp_8085 {
    defaults-from tcp
    destination *.8085
    interval 30
    time-until-up 0
    timeout 91
}
ltm monitor tcp tcp_8181 {
    defaults-from tcp
    destination *.8181
    interval 5
    time-until-up 0
    timeout 16
}

ravi@(F5_1-PRD-Tibco)(cfg-sync In Sync)(Active)(/Common)(tmos) list ltm pool P_VAS_Query_44070
ltm pool P_VAS_Query_44070 {
    members {
        10.64.32.15:44070 {
            address 10.64.32.15
            session monitor-enabled
            state up
        }
        10.64.32.16:44070 {
            address 10.64.32.16
            session monitor-enabled
            state up
        }
        10.64.32.29:44070 {
            address 10.64.32.29
            session monitor-enabled
            state up
        }
        10.64.32.29:44071 {
            address 10.64.32.29
            session monitor-enabled
            state down
        }
        10.64.32.30:44070 {
            address 10.64.32.30
            session monitor-enabled
            state down
        }
        10.64.32.30:44071 {
            address 10.64.32.30
            session monitor-enabled
            state down
        }
        Mumwin03:44070 {
            address 10.64.32.25
            session monitor-enabled
            state up
        }
        Mumwin04:44070 {
            address 10.64.32.26
            session monitor-enabled
            state up
        }
        Mumwin04:44071 {
            address 10.64.32.26
            session monitor-enabled
            state up
        }
        Mumwin04:44072 {
            address 10.64.32.26
            session monitor-enabled
            state down
        }
        Mumwin09:44070 {
            address 10.64.32.12
            session monitor-enabled
            state up
        }
        Mumwin09:44071 {
            address 10.64.32.12
            session monitor-enabled
            state down
        }
        Mumwin09:44072 {
            address 10.64.32.12
            session monitor-enabled
            state down
        }
        Mumwin09:44073 {
            address 10.64.32.12
            session monitor-enabled
            state down
        }
    }
    monitor tcp 
}
(END)

Change your tcpdump to

tcpdump -i 1.15 -ni vlan_internal host 10.64.32.16 and host 10.64.32.35

Change your tcpdump to

tcpdump -i 1.15 -ni vlan_internal host 10.64.32.16 and host 10.64.32.35

deleted tcpdump

deleted tcpdump

deleted tcpdump

ls /var/log/monitors/. Please, don't post a screen capture of packets, its impossible to read. If you want to share captures send them to a pcap file using -w /shared/tmp/name.pcap so you can analyse them off box. The monitor log will be very beneficial to try to isolate down why the monitor would be going down. To turn on monitor logging for a pool member, go into a pool, and click on a member. There should be a check box to enable monitor logging.

Hi Brad, thank you for still helping me,im newbie in F5.

1) i cant find ls /var/log/monitors

2) i cant find how to check logging for pool member, so how can i enable it, and see the log when the pool is down anyway

3) here the tcpdump -i 1.15 -ni vlan_internal host 10.64.32.16 and host 10.64.32.35 -w /shared/tmp/testaja.pcap tcpdump googledrive