Forum Discussion

Christopher_J_B's avatar
Icon for Nimbostratus rankNimbostratus
Nov 09, 2010

High # of transaction / TMM process not sending every log

I have several iRules - logging TCP connection specifics and then a few that parse XML and send to a syslog server to be parsed/indexed by Splunk.



Here is an example of the TCP iRule -





set tcp_start_time [clock clicks -milliseconds]






log -noname local0.warning "DEVICE=SANPRODF5 ENV=PROD APP=CIDCSR COMMENT=TCP SRC=[IP::client_addr] SRCPORT=[TCP::client_port] DST=[IP::local_addr] DSTPORT=[TCP::local_port] OPEN=[expr [clock clicks -milliseconds] - $tcp_start_time]"





Recently been performing load tests (load runner) and the number of transactions from load runner don't jive with the syslog entries (about 30% off). I have been correlating other logs against iRule log entries and they are all off.



Using the iRule editor - I have been clearing/comparing the number of executions for "CLIENT_CLOSED" and that value compared to the syslog entires - those don't jive either.



Any else notice this issue?



Since an upgrade to v10 - I have been using HSL (high speed logging), but that doesn't seem to be helping either.


1 Reply

  • Hi Christopher,



    There have been some reports of HSL logging failing under high load. I suggest opening a case with F5 Support to report the issue and get the latest on the issue.