Forum Discussion

Matt_M_62913's avatar
Matt_M_62913
Icon for Nimbostratus rankNimbostratus
Dec 10, 2012

Heuristic for sysStatHttpRequests?

We are seeing a lot of connections that are not HTTP and that we don't have an ready explanation for. I am getting the number for non-HTTP traffic by getting the total new connections from sysStatClientTotConns and then subtracting the HTTP requests that we get from sysStatHttpRequests.

 

 

In order to figure out what we are seeing, I would like to know what qualifies traffic as HTTP in the F5's SNMP setup? It is anything on port 80? Or does it look for HTTP headers, or some other criteria?

 

 

Thanks!

 

management
monitoring
  • hooleylist's avatar
    hooleylist
    Icon for Cirrostratus rankCirrostratus
    Dec 10, 2012
    Hi Matt,

     

     

    I think the sysStatHttpRequests is counting the HTTP requests to any virtual server with an HTTP profile. Clients can reuse the same TCP connection to send multiple requests, so I'm not sure you'll be able to get a simple count of non-HTTP connections using these two metrics. Can you look at virtual servers without an HTTP profile to get the non-HTTP connection counts?

     

     

    Aaron
  • Matt_M_62913's avatar
    Matt_M_62913
    Icon for Nimbostratus rankNimbostratus
    Dec 10, 2012
    Clients can reuse the same TCP connection to send multiple requests, so I'm not sure you'll be able to get a simple count of non-HTTP connections using these two metrics.

     

     

    Good point, but that would imply that Connections get undercounted compared to HTTP requests. Here's the type of numbers we are seeing:

     

     

    New Connections: 14,200 / second

     

    HTTP Requests: 7,948 / second

     

     

    Which leaves about 6,200 new connections that are not HTTP, and these servers should not really be seeing any non-HTTP traffic, except for an occasional SSH connection.

     

     

    There is a lot of request/response traffic over cURL, but that all goes to port 80, so I was thinking it should be counted in the HTTP totals -- Thus my original question. I will need to take a look at the HTTP profile. FWIW, my prime responsibility is the servers behind the F5 - another person actually manages our F5's.

     

     

    Can you look at virtual servers without an HTTP profile to get the non-HTTP connection counts?

     

     

    Not easily. All the servers behind the F5 are serving HTTP traffic - I don't think we have any virtual servers set up without the HTTP profile, except for the afrementioned SSH traffic, but that totals up to a few connections per day, not per second, so it should not affect the math much at all.

     

  • hooleylist's avatar
    hooleylist
    Icon for Cirrostratus rankCirrostratus
    Dec 10, 2012
    Someone with admin access to the BIG-IP should be able to check the virtual server connection counts to see which virtual server(s) without an HTTP profile are receiving connections.

     

     

    Aaron
  • Matt_M_62913's avatar
    Matt_M_62913
    Icon for Nimbostratus rankNimbostratus
    Dec 12, 2012
    OK, it looks like some of our virtual servers are set up as the Performance Layer 4 type, which does not have the HTTP profile option (even though they are handling HTTP traffic). Is that likely to be the source of the traffic that shows as non-HTTP? If so, it looks like monitoring the sysStatHttpRequests OID will not be useful for us.