For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

shlomi_133455's avatar
shlomi_133455
Icon for Nimbostratus rankNimbostratus
Jun 02, 2016

iRule Total Executions VS Virtual Server Requests

Hello All,

 

I am trying to wrap my head around something I have trouble understanding.

 

I have 2 Virtuals with very similar iRules: ( same irule with different DataGroups )

 

when RULE_INIT { Log unknown requests? 0 = no, 1 = yes set static::log_unknown_requests 0 Log accepted requests? 0 = no, 1 = yes set static::log_accepted_requests 0 } when HTTP_REQUEST { if { [class match [IP::client_addr] equals WhiteLIst] }{ } else { virtual BlockedIP } }

 

the thing i am trying to understand and having trouble with it the number of "Total Executions" of the iRule VS the number of requests that the Virtual Service is getting.

 

for one Virtual Server I have number of Request = Total Executions for the second Virtual Server i have for example 3 milions reqeusts in one hour with 18K to Total Executions in the iRule.

 

can someone help me understand what am I missing, doesn't the iRule suppose to trigger for every request?

 

11 Replies

  • Hi,

     

    First of all, the total execution is reset when you update the irule or when you press reset to do it manually. The counter increment only when there is an action triggered on the event. Are you sure that both tests are the same and trigger the same workflow on the HTTP_REQUEST event ?

     

    • shlomi_133455's avatar
      shlomi_133455
      Icon for Nimbostratus rankNimbostratus
      Hi, first of all thank you for your fast response. I know that Edit and Reset clear the statistics, I reset the statistics couple of times today to get to my conclusion. second, my Virtual represents a WebService, all of the requests for the WebService are qualified as HTTP_request as much as i know, am i wrong?
    • Yann_Desmarest_'s avatar
      Yann_Desmarest_
      Icon for Nacreous rankNacreous
      As long as, your requests are RFC compliant to HTTP, requests should trigger the HTTP_EVENT. But in your case, I think that the counter increase only if you trigger "virtual BlockedIP"
    • shlomi_133455's avatar
      shlomi_133455
      Icon for Nimbostratus rankNimbostratus
      that also doesn't make any sense as my blockedIP virtual doesn't get enough traffic from these irules. also i can see in my pool that 99% of the traffic does get through on both Virtual and still the behavioral is different
  • Hi,

     

    First of all, the total execution is reset when you update the irule or when you press reset to do it manually. The counter increment only when there is an action triggered on the event. Are you sure that both tests are the same and trigger the same workflow on the HTTP_REQUEST event ?

     

    • shlomi_133455's avatar
      shlomi_133455
      Icon for Nimbostratus rankNimbostratus
      Hi, first of all thank you for your fast response. I know that Edit and Reset clear the statistics, I reset the statistics couple of times today to get to my conclusion. second, my Virtual represents a WebService, all of the requests for the WebService are qualified as HTTP_request as much as i know, am i wrong?
    • Yann_Desmarest's avatar
      Yann_Desmarest
      Icon for Cirrus rankCirrus
      As long as, your requests are RFC compliant to HTTP, requests should trigger the HTTP_EVENT. But in your case, I think that the counter increase only if you trigger "virtual BlockedIP"
    • shlomi_133455's avatar
      shlomi_133455
      Icon for Nimbostratus rankNimbostratus
      that also doesn't make any sense as my blockedIP virtual doesn't get enough traffic from these irules. also i can see in my pool that 99% of the traffic does get through on both Virtual and still the behavioral is different
  • I believe I have found the differences between the Virtual Servers. the Virtual server that doesn't Execute the iRule for every request has OneConnect Profile define on it, which i believe makes the irule skip part of the connections due to Presidency and oneConnect to the client. I will update after some tests