For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

bdo_isd_28658's avatar
bdo_isd_28658
Icon for Nimbostratus rankNimbostratus
Jul 27, 2009

LTM log query

Hi,     Can you let me know if when I see this in the LTM log ...     Jul 27 17:11:20 bip01 bigd[1917]: 01060001:5: Service detected DOWN for ::ffff:10.1.20.180:80 monitor test_m...
management
monitoring
hoolio's avatar
hoolio
Icon for Cirrostratus rankCirrostratus
Jul 28, 2009
I'm not sure whether it matters or not, but typically the header name would be in title case, Connection and Host. The server may or may not parse it regardless of case. And the host header value should only contain the host--not the URI. So the send string should look like this:

 

 

GET /monitoring.html HTTP/1.1\r\nHost: myserver\r\nConnection: close\r\n

 

 

You might try running tcpdump on the LTM and server to compare the results when the monitor requests fail. Filtering by source IP and destination IP and port will help limit the tcpdump file sizes.

 

 

Aaron