ltm to server connection time

Darkside,

 

 

Myself, I'd run tcpdump on the box and open it up in wireshark to get the timings. I've found this method useful in the past when I've done a tcpdump on the client and server sides to see where any delays may be.

 

 

Rgds

 

N

I figured as much, course that means I'll need to run the dump when this problem is happening rather than review some logs the next day as I'd hoped.

 

 

-DarkSide

I'd get that tcpdump primed and ready for action. Seriously though, if everything is working fine at the moment it would also be a good time to run the command. At least then when the problem occurs you've got a baseline to compare it to.

 

 

N

What protocol(s) is this for? For HTTP, you could save a timestamp in an iRule in HTTP_REQUEST and check the delta in SERVER_CONNECTED. If it's over X, you could use High Speed Logging to send a message to a pool of syslog servers.

 

 

http://devcentral.f5.com/wiki/iRules.hsl.ashx

 

 

Or if it's for troubleshooting a specific issue, tcpdump is a good option as Nathan said.

 

 

Aaron

you could get close (but no finer than a ms) with an iRule by storing the time in HTTP_REQUEST_SEND (assuming http) and then do a diff in the SERVER_CONNECTED event. You might also experiment with IP::stats age and TCP::rtt in the SERVER_CONNECTED event.

 

 

http://devcentral.f5.com/wiki/iRules.TCP__rtt.ashx Click Here

 

http://devcentral.f5.com/wiki/iRules.IP__stats.ashx Click Here

Darkside,

 

Another thought - if you're having intermittant connection / delay issues, rather than just looking for metrics / data, and you're using HTTP (a presumption on my part) have you considered a OneConnect profile on the VIP?

 

 

Quote: "The OneConnect feature works with HTTP Keep-Alives to allow the BIG-IP system to minimize the number of server-side TCP connections by making existing connections available for reuse by other clients".

 

 

If you're issues are server side then this may help. Just thought I'd add this.

 

 

Rgds

 

N

 

 

It is indeed HTTP and a situation where something isn't performing well so it *must* be the LTM. :-) I'll get a tcpdump ready for action and review the links y'all provided as well.

 

 

Thanks,

 

-DarkSide