iRules, CPU, and breaking the world

I think TMM will get restarted after it gets too busy to answer heartbeats. How long are you trying to keep CPU1 (or the TMM CPU(s)) highly utilized? A simple way to trigger a TMM restart would be to increment a counter forever:

when CLIENT_ACCEPTED {

   set i 0
   while {1} {
      incr i
   }
}

Aaron

You'll know that you're starting to constrain when you see 'clock skipped xxx ticks' messages in /var/log/ltm. They indicate a CPU constraint and generally mean that you're in trouble. Crash away!

 

 

-Matt

Now this is a fun one. If you really want to stress out the TMM, you need to do something that's CPU intensive but doesn't block and thus cause a restart. In thinking to our optimization list on iRules and reversing it, I came up with these two items that could make things fun.

1. Use very large variables.

2. Use regular expressions.

I think the following iRule does just that. It creates a string of numbers from 0-9 repeated 10k times (for a total of a 100k string). It then uses the credit card scrubber iRule to traverse that string.

when HTTP_REQUEST {
  set s [string repeat 0123456789 10000]
  set regex {(?:3[4|7]\d{2})(?:[ ,-]?(?:\d{5}(?:\d{1})?)){2}|(?:4\d{3})(?:[ ,-]?(?:\d{4})){3}|(?:5[1-5]\d{2})(?:[ ,-]?(?:\d{4})){3}|(?:6011)(?:[ ,-]?(?:\d{4})){3}}
    set idx [regexp -all -inline -indices $regex $s];
    HTTP::respond 200 content "regex completed";
}

Now, that in itself won't lock things up as it seems to return sub-second for me. You will now have to throw in a script that queries the virtual the iRule is running on. ApacheBench (ab) is installed on the BIG-IP and you can easily use that. Point it at your virtual for a couple hundred thousand requests or so and it seems to drive the TMMs right up to the 100% mark.

ab -c 10 -n 10000 http://virtualserver/

Just plug in the external virtual address of your virtual server into virtualserver and you are set to go. Feel free to increase the numbers if you want to test to run longer.

Just don't tell product support we recommended this B-).

-Joe

I got one of these from someone internally, it really cooked my CPU, helped when I was building out the CPU cacti templates for v10:

when CLIENT_ACCEPTED {
  after 1 -periodic {
    set i 0
    while { $i < 150 } {
      sha512 [expr [expr 188888 * rand()] / 8675309]
      incr i
     }
   }
  TCP::collect
}