Forum Discussion
smp_86112
Cirrostratus
CirrostratusHTTP monitor recv string
Can someone point me to the doc that describes the different ways a 9.3.1 LTM can interpret the receive string of an HTTP monitor?
We have our LTMs looking for part of a date string which appears in upper-case in the HTML, but also appears in lowercase in the HTTP Date header during the month of October. I think we assumed for a long time that the receive string is case-sensitive, but our testing confirmed it is not. Now, and none of our pool members are being marked down when they return a 404 or 500, for example, because the Date: header contains the recv string, just in a different case.
SOL5917 also gives some additional info, but not much.
5 Replies
hoolioI'd guess there is an inferred case insensitivity flag added to the evaluation of the receive string against the response content. SOL4186 gives details on the escape sequences which can be used in a monitor send or receive string:
SOL4186: Entering escape sequences in an ECV health monitor's send and receive strings
https://support.f5.com/kb/en-us/solutions/public/4000/100/sol4186.html
Maybe you could enter the escape sequences for the characters in uppercase (using the hex values for the characters in this format: \xHH)? Else is there another string that you can match on that appears only in a successful response?
Aaron
smp_86112Nice reference, thanks. I was thinking I saw somewhere we could use hex codes, but I couldn't find the doc in a pinch. Given the way our application infrastructure is designed, there is no other string we can look for. In the end, we tried a simple regular expression that worked fortunately. After having a bit more time I found this:
SOL5917 - Using regular expressions in a health monitor receive string
https://support.f5.com/kb/en-us/solutions/public/5000/900/sol5917.html
It just seems like a simple question like "are recv strings case sensitive?", or "what types of strings can be used in a monitor recv string?" are either very difficult to find, or is not addressed at all in the doc. And that is the type of thing that is really frustrating as a customer. I don't know, maybe my problem is with the search feature of ask.f5.com and not the doc...
Thanks Hoolio.- smp_86112Another fine reference Hoolio - what would the community be without you?
I posted my feedback there. That type of forum was a very smart idea. 
Wand_97484Nimbostratus
Hi,
I have a small question regarding the receive string as well.
I'm trying to setup a http monitor at a F5 GTM 9.4.8 HF4, which should detect the following string:
"running (lb)"
I tried different strings in the receive string field, but none worked:
"running \(lb\)" - escaping the brakets
"running (lb) - without escaping the brakets
The only receive string that worked is "running" but this is not sufficient, because I need to catch the "(lb)" part as well.
If I test the string "running (lb)" against the regex "running \(lb\)" at http://www.sweeting.org/mark/html/revalid.php I get a match, but the LTM marks the server as down.
BR
Jens- hoolioHi Jens,
Can you try using \x_28 and \x_29 without the underscores:
running \x_28lb\x_29
SOL4186: Entering escape sequences in an ECV health monitor's send and receive strings
https://support.f5.com/kb/en-us/solutions/public/4000/100/sol4186.html
Aaron
