For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

ol_98173's avatar
ol_98173
Icon for Nimbostratus rankNimbostratus
Feb 23, 2009

Health Monitor and java broken pipe in Tomcat

Heya All,

 

 

I've created health monitor on our LTM:

 

GET /192.168.0.2:8080/sub/index/?remotecall=info HTTP/1.1\r\nUser-Agent: F5 loadbalancer\r\nHost: 192.168.0.3\r\nConnection: Close\r\n

 

 

Note, that ip address in the GET request is intentional, not a mistake!

 

I've modified User-agent, to be passed to Tomcat as "F5 loadbalancer"

 

as a result from this HTTP monitor I'm expecting server to return it's IP address, so in this case 192.168.0.2, what works fine in 5 out of 6 times.

 

 

And here comes the problem:

 

every 30 seconds there appears "broken pipe" error in the Tomcat Log. see below:

 

"ClientAbortException: java.net.SocketException: Broken pipe"

 

I do not understand Java at all, but ClientAbort Exception sounds like if Client (F5 balancer) aborted the session.

 

The monitor is setup in order so the node in the pool is monitored every 5 seconds.

 

Is the monitor setup syntactically ok?

 

management
monitoring

2 Replies

  • hoolio's avatar
    hoolio
    Icon for Cirrostratus rankCirrostratus
    Feb 23, 2009
    You could capture a tcpdump of the traffic to get a clearer idea of the symptoms of the problem:

     

     

    tcpdump -ni 0.0 -s0 -w/var/tmp/monitor.dmp host 192.168.0.2

     

     

    If you need help interpreting the tcpdump, check SOL411 (Click here), SOL1893 (Click here), or you can open a case with F5 Support.

     

     

    Aaron
  • dennypayne's avatar
    dennypayne
    Icon for Employee rankEmployee
    Feb 23, 2009
    Hi,

    It looks fine to me, I'm wondering if a tcpdump would show a properly closed connection each time. You could run 

     
 tcpdump -ni  host  and host 192.168.0.2

    and try to see what's happening with the monitor connections (FIN, RST, etc).

    I've seen some applications where 5 seconds is too aggressive on the interval and I've had to back off a bit.

    Denny