For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Doug_104173's avatar
Doug_104173
Icon for Nimbostratus rankNimbostratus
Aug 31, 2010

GET causes send string to send twice

Hi, I have the LTM VE running 10.2 and i'm trying to monitor some HTTP nodes in EC2. For some reason a http health check I created is sending the GET string twice. Here is my health check: 

list ltm monitor http Cassandra_Check_80 
ltm monitor http Cassandra_Check_80 {
    defaults-from http
    destination *:80
    interval 5
    recv "double rainbow"
    send "GET /status/check"
    time-until-up 0
    timeout 16

and here is what I see in the nginx access logs:
 [31/Aug/2010:15:53:17 -0400] "GET /status/checkGET /status/check" 400 173 "-" "-"
[31/Aug/2010:15:53:26 -0400] "GET /status/checkGET /status/check" 400 173 "-" "-"
 [31/Aug/2010:15:53:37 -0400] "GET /status/checkGET /status/check" 400 173 "-" "-"
 [31/Aug/2010:15:53:47 -0400] "GET /status/checkGET /status/check" 400 173 "-" "-"
 [31/Aug/2010:15:53:56 -0400] "GET /status/checkGET /status/check" 400 173 "-" "-"
[31/Aug/2010:15:54:07 -0400] "GET /status/checkGET /status/check" 400 173 "-" "-"
 [31/Aug/2010:15:54:17 -0400] "GET /status/checkGET /status/check" 400 173 "-" "-"

If I use anything other than GET in capital letters, the log shows it fine.  But once I use GET in caps, it appears in there twice.
management
monitoring

4 Replies

  • Chris_Miller's avatar
    Chris_Miller
    Icon for Altostratus rankAltostratus
    Sep 01, 2010
    Try using this for your GET string: 

    GET /status/check HTTP/1.1\r\nHost:  \r\nConnection: Close\r\n\r\n
  • Doug_104173's avatar
    Doug_104173
    Icon for Nimbostratus rankNimbostratus
    Sep 01, 2010
    Closer, but that still no luck, it yields this in the logs: 

    [01/Sep/2010:10:24:36 -0400] "GET /status/check HTTP/1.1" 400 173 "-" "-"
  • L4L7_53191's avatar
    L4L7_53191
    Icon for Nimbostratus rankNimbostratus
    Sep 01, 2010
    The 400 response means the server doesn't like the request. Have you tried passing in a valid hostname for the Host: header above?

     

     

    -Matt
  • smp_86112's avatar
    smp_86112
    Icon for Cirrostratus rankCirrostratus
    Sep 02, 2010
    I probably misunderstand the symptom, but just in case...

     

     

    If you have an Active and Standby in an HA pair, both units perform their own checks. So if you are running an HA pair you'll see hits in the access logs for the send string, but those seemingly duplicate log entries represent checks by two independent systems.