Forum Discussion
Heuristic for sysStatHttpRequests?
We are seeing a lot of connections that are not HTTP and that we don't have an ready explanation for. I am getting the number for non-HTTP traffic by getting the total new connections from sysStatClientTotConns and then subtracting the HTTP requests that we get from sysStatHttpRequests.
In order to figure out what we are seeing, I would like to know what qualifies traffic as HTTP in the F5's SNMP setup? It is anything on port 80? Or does it look for HTTP headers, or some other criteria?
Thanks!
- hooleylistCirrostratusHi Matt,
- Matt_M_62913NimbostratusClients can reuse the same TCP connection to send multiple requests, so I'm not sure you'll be able to get a simple count of non-HTTP connections using these two metrics.
Good point, but that would imply that Connections get undercounted compared to HTTP requests. Here's the type of numbers we are seeing:
Not easily. All the servers behind the F5 are serving HTTP traffic - I don't think we have any virtual servers set up without the HTTP profile, except for the afrementioned SSH traffic, but that totals up to a few connections per day, not per second, so it should not affect the math much at all.
- hooleylistCirrostratusSomeone with admin access to the BIG-IP should be able to check the virtual server connection counts to see which virtual server(s) without an HTTP profile are receiving connections.
- Matt_M_62913NimbostratusOK, it looks like some of our virtual servers are set up as the Performance Layer 4 type, which does not have the HTTP profile option (even though they are handling HTTP traffic). Is that likely to be the source of the traffic that shows as non-HTTP? If so, it looks like monitoring the sysStatHttpRequests OID will not be useful for us.
Recent Discussions
Related Content
* Getting Started on DevCentral
* Community Guidelines
* Community Terms of Use / EULA
* Community Ranking Explained
* Community Resources
* Contact the DevCentral Team
* Update MFA on account.f5.com