Hello, I was wondering if anyone has some examples of a i-rule to persist on primary and secondary nodes for Weblogic v10. I seen some older posts on doing this but they where using jsession uri, We use JSESSION cookies. Thanks,

Have you had a look at this? http://devcentral.f5.com/Wiki/default.aspx/iRules/Weblogic_JSessionID_Persistence.html -Matt

Matt, I have an I-rule that I wrote to successfully persist on JSESSIONID. The issue I am having is that we mirror our weblogic sessions to a fallback server. In order to use this fallback feature while loadbalancing your bea servers with F5 is being able to write an i-rule to grab the JSESSIONID and split it into 3 values cookie, Primary Server, Secondary Server. The catch is that the Primary and Secondary Server Ip, Port is hashed. I'm not real sure that there is a way to decode this hash. So my next thought was to figure out what hash value goes with what IP and hardcode those ip's in the i-rule. The only problem with this is that the hash values change every time you restart the server so that is not a good solution. My question is has anyone seen this, or have been down this road successfully or unsuccesfully. Thanks, Brett

Hi Brett, Can you post a few examples of the cookie values and which primary and secondary server IP's/ports they correspond to? You could potentially try to use a similar method as this example--just change the parsing of the value from the URI to the cookie and replace some of the regexp commands with string functions: http://devcentral.f5.com/Default.aspx?tabid=53&forumid=5&tpage=1&view=topic&postid=18948 Thanks, Aaron

Unfortunately I cannot provide that information being that I work on a restricted site. I have looked at the i-rule you are referencing and it would work if only I can decode the hash to Ip Addresses. -Brett

Hi Brett, If the ID's are true one way hashes, it actually wouldn't actually help to see examples. I wonder if the server which sets the cookie always lists itself as the first node in the jsessionid cookie value? If so, you could keep a mapping of the current hashes and work out which server IP:port a secondary hash corresponds to once that server had set a cookie. Load Balancers and the WebLogic Session Cookie http://download.oracle.com/docs/cd/E11035_01/wls100/cluster/load_balancing.htmlwp1028843 The format of a session cookie is: sessionid!primary_server_id!secondary_server_id where: * sessionid is a randomly generated identifier of the HTTP session. The length of the value is configured by the IDLength parameter in the element in the weblogic.xml file for an application. By default, the sessionid length is 52 bytes. * primary_server_id and secondary_server_id are 10 character identifiers of the primary and secondary hosts for the session. Note: For sessions using non-replicated memory, cookie, JDBC, or file-based session persistence, the secondary_server_id is not present. For sessions that use in-memory replication, if the secondary session does not exist, the secondary_server_id is “NONE”. If that seems plausible, let me know and I'll try to come up with a rough version for you to try testing. Also, can you confirm which LTM version you're running? Thanks, Aaron

JSESSIONID Cookie failover

36 Replies

Danardono1
Nimbostratus
Sep 19, 2010
Hi Hoolio,

I tested on production enviroment, but some user experience problem. There are log on weblogic that show , the traffic send to wrong server. FYI, we use TMOS 10.1 HF2

<[ACTIVE] ExecuteThread: '1' for queue: 'weblogic.kernel.Default (self-tuning)'> <> <> <> <1283817499961> CMSWeb1, a server that is neither the primary (6213997039278044148S:192.168.68.65:[8003,8003,-1,-1,-1,-1,-1]:CMSWebDomain:CMSWeb5) nor the secondary (4020668254789391387S:192.168.68.66:[8003,8003,-1,-1,-1,-1,-1]:CMSWebDomain:CMSWeb6). The request URL was: https://xxx.yyy.co.id:443/corp/common/login.do>

and on F5 log, we found a strange log

Sep 7 07:27:16 local/tmm info tmm[5149]: Rule irule_weblogic : 124.195.16.245:2875: POST to xxx.yyy/corp/common/login.do?action=login cookie: dTctMFQbQTBvLLvD6L1QTrXW5L1Lh3p39740NPNQVrdVyJBTvyY5!865954505!-983302054

Sep 7 07:27:16 local/tmm info tmm[5149]: Rule irule_weblogic : 124.195.16.245:2875: Scanning cookie: dTctMFQbQTBvLLvD6L1QTrXW5L1Lh3p39740NPNQVrdVyJBTvyY5!865954505!-983302054

Sep 7 07:27:16 local/tmm info tmm[5149]: Rule irule_weblogic : 124.195.16.245:2875: Scanned: dTctMFQbQTBvLLvD6L1QTrXW5L1Lh3p39740NPNQVrdVyJBTvyY5 865954505 -983302054

Sep 7 07:27:16 local/tmm info tmm[5149]: Rule irule_weblogic : 124.195.16.245:2875: Cookie: dTctMFQbQTBvLLvD6L1QTrXW5L1Lh3p39740NPNQVrdVyJBTvyY5!865954505!-983302054 pri: 865954505; sec: -983302054; pri UIE: pool_cms 10.44.133.21 9003; sec UIE: pool_cms 10.44.133.22 9004

Sep 7 07:27:16 local/tmm info tmm[5149]: Rule irule_weblogic : 124.195.16.245:2875: Using primary UIE persistence

Sep 7 07:27:16 local/tmm info tmm[5149]: Rule irule_weblogic : 124.195.16.245:2875: Cookie: PVs8MFQHvT7MrVyyS1ZxZG1hTRLXr9Rn7hd8tJ36vNQvhPWmJLxX!865954505!-983302054

Sep 7 07:27:16 local/tmm info tmm[5149]: Rule irule_weblogic : 124.195.16.245:2875: Adding: persist add uie 865954505 3600

Sep 7 07:27:16 local/tmm info tmm[5149]: Rule irule_weblogic : 124.195.16.245:2875: Cookie: PVs8MFQHvT7MrVyyS1ZxZG1hTRLXr9Rn7hd8tJ36vNQvhPWmJLxX!865954505!-983302054 set by 10.44.133.21:9001, UIE: pool_cms 10.44.133.21 9003

There is different server information on setby and UIE on HTTP RESPONSE (set by 10.44.133.21:9001, UIE: pool_cms 10.44.133.21 9003).

For normal condition, the log show like this

-------------------------------------------

Sep 7 07:27:17 local/tmm1 info tmm1[5160]: Rule irule_weblogic : 124.195.16.245:60486: GET to xxx.yyy/corp/common/login.do?action=callMainPopUpBNI cookie: PVs8MFQHvT7MrVyyS1ZxZG1hTRLXr9Rn7hd8tJ36vNQvhPWmJLxX!865954505!-983302054

Sep 7 07:27:17 local/tmm1 info tmm1[5160]: Rule irule_weblogic : 124.195.16.245:60486: Scanning cookie: PVs8MFQHvT7MrVyyS1ZxZG1hTRLXr9Rn7hd8tJ36vNQvhPWmJLxX!865954505!-983302054

Sep 7 07:27:17 local/tmm1 info tmm1[5160]: Rule irule_weblogic : 124.195.16.245:60486: Scanned: PVs8MFQHvT7MrVyyS1ZxZG1hTRLXr9Rn7hd8tJ36vNQvhPWmJLxX 865954505 -983302054

Sep 7 07:27:17 local/tmm1 info tmm1[5160]: Rule irule_weblogic : 124.195.16.245:60486: Cookie: PVs8MFQHvT7MrVyyS1ZxZG1hTRLXr9Rn7hd8tJ36vNQvhPWmJLxX!865954505!-983302054 pri: 865954505; sec: -983302054; pri UIE: pool_cms 10.44.133.21 9003; sec UIE: pool_cms 10.44.133.22 9004

Sep 7 07:27:17 local/tmm1 info tmm1[5160]: Rule irule_weblogic : 124.195.16.245:60486: Using primary UIE persistence

Sep 7 07:27:17 local/tmm1 info tmm1[5160]: Rule irule_weblogic : 124.195.16.245:60486: Selected server pool_cms 10.44.133.21 9003

Sep 7 07:27:17 local/tmm1 info tmm1[5160]: Rule irule_weblogic : 124.195.16.245:60486: Connected server 10.44.133.21:9003

Sep 7 07:27:17 local/tmm1 info tmm1[5160]: Rule irule_weblogic : 124.195.16.245:60486: Cookie: PVs8MFQHvT7MrVyyS1ZxZG1hTRLXr9Rn7hd8tJ36vNQvhPWmJLxX!-758494554!769404233

Sep 7 07:27:17 local/tmm1 info tmm1[5160]: Rule irule_weblogic : 124.195.16.245:60486: Adding: persist add uie -758494554 3600

Sep 7 07:27:17 local/tmm1 info tmm1[5160]: Rule irule_weblogic : 124.195.16.245:60486: Cookie: PVs8MFQHvT7MrVyyS1ZxZG1hTRLXr9Rn7hd8tJ36vNQvhPWmJLxX!-758494554!769404233 set by 10.44.133.21:9003, UIE: pool_cms 10.44.133.21 9003

Thanks n Regards

-Dafa13
Austin_Geraci
MVP
Sep 19, 2010
Reall good info, thanks guys!
hoolio
Cirrostratus
Sep 20, 2010
Hi Dafa13,

Is it possible that the connection to the primary server failed for that specific request? Do you have the LB_FAILED event logging uncommented? If not, could you enable it? Do you see any errors on the primary web app from that time?

Also, the forums remove any strings which look like HTML tags. If you post logs again, can you remove the angle brackets from the iRule event names?

Thanks, Aaron
Danardono1
Nimbostratus
Sep 22, 2010
Hi Hoolio,

I repost the log. On error condition, i also do not find LB_SELECTED or SERVER_CONNECTED log.

error condition

--------------------

Sep 7 07:27:16 local/tmm info tmm[5149]: Rule irule_weblogic HTTP_REQUEST: 124.195.16.245:2875: POST to xxx.yyy.co.id/corp/common/login.do?action=login cookie: dTctMFQbQTBvLLvD6L1QTrXW5L1Lh3p39740NPNQVrdVyJBTvyY5!865954505!-983302054

Sep 7 07:27:16 local/tmm info tmm[5149]: Rule irule_weblogic HTTP_REQUEST: 124.195.16.245:2875: Scanning cookie: dTctMFQbQTBvLLvD6L1QTrXW5L1Lh3p39740NPNQVrdVyJBTvyY5!865954505!-983302054

Sep 7 07:27:16 local/tmm info tmm[5149]: Rule irule_weblogic HTTP_REQUEST: 124.195.16.245:2875: Scanned: dTctMFQbQTBvLLvD6L1QTrXW5L1Lh3p39740NPNQVrdVyJBTvyY5 865954505 -983302054

Sep 7 07:27:16 local/tmm info tmm[5149]: Rule irule_weblogic HTTP_REQUEST: 124.195.16.245:2875: Cookie: dTctMFQbQTBvLLvD6L1QTrXW5L1Lh3p39740NPNQVrdVyJBTvyY5!865954505!-983302054 pri: 865954505; sec: -983302054; pri UIE: pool_cms 10.44.133.21 9003; sec UIE: pool_cms 10.44.133.22 9004

Sep 7 07:27:16 local/tmm info tmm[5149]: Rule irule_weblogic HTTP_REQUEST: 124.195.16.245:2875: Using primary UIE persistence

Sep 7 07:27:16 local/tmm info tmm[5149]: Rule irule_weblogic HTTP_RESPONSE: 124.195.16.245:2875: Cookie: PVs8MFQHvT7MrVyyS1ZxZG1hTRLXr9Rn7hd8tJ36vNQvhPWmJLxX!865954505!-983302054

Sep 7 07:27:16 local/tmm info tmm[5149]: Rule irule_weblogic HTTP_RESPONSE: 124.195.16.245:2875: Adding: persist add uie 865954505 3600

Sep 7 07:27:16 local/tmm info tmm[5149]: Rule irule_weblogic HTTP_RESPONSE: 124.195.16.245:2875: Cookie: PVs8MFQHvT7MrVyyS1ZxZG1hTRLXr9Rn7hd8tJ36vNQvhPWmJLxX!865954505!-983302054 set by 10.44.133.21:9001, UIE: pool_cms 10.44.133.21 9003

normal condition

-----------------

Sep 7 07:27:17 local/tmm1 info tmm1[5160]: Rule irule_weblogic HTTP_REQUEST: 124.195.16.245:60486: GET to xxx.yyy.co.id/corp/common/login.do?action=callMainPopUpBNI cookie: PVs8MFQHvT7MrVyyS1ZxZG1hTRLXr9Rn7hd8tJ36vNQvhPWmJLxX!865954505!-983302054

Sep 7 07:27:17 local/tmm1 info tmm1[5160]: Rule irule_weblogic HTTP_REQUEST: 124.195.16.245:60486: Scanning cookie: PVs8MFQHvT7MrVyyS1ZxZG1hTRLXr9Rn7hd8tJ36vNQvhPWmJLxX!865954505!-983302054

Sep 7 07:27:17 local/tmm1 info tmm1[5160]: Rule irule_weblogic HTTP_REQUEST: 124.195.16.245:60486: Scanned: PVs8MFQHvT7MrVyyS1ZxZG1hTRLXr9Rn7hd8tJ36vNQvhPWmJLxX 865954505 -983302054

Sep 7 07:27:17 local/tmm1 info tmm1[5160]: Rule irule_weblogic HTTP_REQUEST: 124.195.16.245:60486: Cookie: PVs8MFQHvT7MrVyyS1ZxZG1hTRLXr9Rn7hd8tJ36vNQvhPWmJLxX!865954505!-983302054 pri: 865954505; sec: -983302054; pri UIE: pool_cms 10.44.133.21 9003; sec UIE: pool_cms 10.44.133.22 9004

Sep 7 07:27:17 local/tmm1 info tmm1[5160]: Rule irule_weblogic HTTP_REQUEST: 124.195.16.245:60486: Using primary UIE persistence

Sep 7 07:27:17 local/tmm1 info tmm1[5160]: Rule irule_weblogic LB_SELECTED: 124.195.16.245:60486: Selected server pool_cms 10.44.133.21 9003

Sep 7 07:27:17 local/tmm1 info tmm1[5160]: Rule irule_weblogic SERVER_CONNECTED: 124.195.16.245:60486: Connected server 10.44.133.21:9003

Sep 7 07:27:17 local/tmm1 info tmm1[5160]: Rule irule_weblogic HTTP_RESPONSE: 124.195.16.245:60486: Cookie: PVs8MFQHvT7MrVyyS1ZxZG1hTRLXr9Rn7hd8tJ36vNQvhPWmJLxX!-758494554!769404233

Sep 7 07:27:17 local/tmm1 info tmm1[5160]: Rule irule_weblogic HTTP_RESPONSE: 124.195.16.245:60486: Adding: persist add uie -758494554 3600

Sep 7 07:27:17 local/tmm1 info tmm1[5160]: Rule irule_weblogic HTTP_RESPONSE: 124.195.16.245:60486: Cookie: PVs8MFQHvT7MrVyyS1ZxZG1hTRLXr9Rn7hd8tJ36vNQvhPWmJLxX!-758494554!769404233 set by 10.44.133.21:9003, UIE: pool_cms 10.44.133.21 9003
Danardono1
Nimbostratus
Sep 22, 2010
On the log above, the LB_FAILED event logging is uncommented, and there are no any error on primary web app. For small user on testing enviroment , the irule working good, but when we do on production enviroment, we found the error.
hoolio
Cirrostratus
Sep 22, 2010
It sounds like the iRule might be working correctly, but an existing serverside connection is being re-used. Do you have a OneConnect profile associated with the VS? Are the serverside connections being SNAT'd? If you don't have OneConnect enabled, can you create a custom OneConnect profile and add it to the VS? If you're using SNAT, then leave the source mask set to 0.0.0.0 to reuse the serverside connections for all clients. If you don't use SNAT, then set the source mask to 255.255.255.255.

For details on OneConnect, you can check the wiki page:

OneConnect

http://devcentral.f5.com/wiki/default.aspx/AdvDesignConfig/oneconnect.html

Aaron
Danardono1
Nimbostratus
Sep 24, 2010
Hi Hoolio, i will test it.

I have question about oneconnect, is there any relation between oneconnect with persistence? and why we need oneconnect for this case.

Thank you

Dafa13
hoolio
Cirrostratus
Sep 25, 2010
Hi Dafa13,

Without OneConnect enabled, LTM will open a serverside connection when a new clientside TCP connection has been established. If multiple clients connect over the same clientside TCP connection, those clients will be sent to the same serverside connection even if the persistence info each client presents points to a different pool member. When you enable OneConnect, among other things, LTM will parse each HTTP request to see if a new serverside connection is required to persist the request to a different server regardless of the current serverside connection open.

This is described more completely in the links on the OneConnect wiki page: http://devcentral.f5.com/wiki/default.aspx/AdvDesignConfig/oneconnect.html

Aaron
Danardono1
Nimbostratus
Sep 25, 2010
Hi hoolio,

thank you for the oneconnect information.

We have activated the oneconnect, we use SNAT configuration and use 0.0.0.0/0 on one connect source address profile, but we still experience the same problem.

Do you have information about F5 TMOS version that use this irule on production? maybe we need to downgrade the TMOS.

Thanks n Regards
hoolio
Cirrostratus
Sep 27, 2010
Can you post anonymized copies of the current VS config, iRule and /var/log/ltm logs showing a success and failure?

Thanks, Aaron

Forum Discussion

JSESSIONID Cookie failover

36 Replies

F5 Academy at AppWorld 2026

Introducing the F5 AI Assistant for BIG-IP

Recent Discussions

F5 BIG IP laboratory license

After upgrading from PeopleTools 8.59.11 to 8.61.11 F5 APM is not rewriting the internal URLs

F5 mssql health monitor failing

How can I get started with iCall

Connection Rest f5

Related Content

Weblogic JSessionID Persistence

Configuring AWS HA Failover Across AZs Without EIPs Using F5 Cloud Failover Extension (CFE)

Weblogic JSessionID Persistence for Session Replication

Cookie-based DDoS protection

Encrypting Cookies

ABOUT DEVCENTRAL

RESOURCES

SUPPORT

PARTNERS