modifying config on the fly

You mean other than just change the value via the GUI or tmsh? Of course, I assume the new value will only apply when the existing allowed connections drain down to the lower value.

the person controlling this value will not have access to gui or shell. The preferable method would be to let them drain down, but I think chopping would be acceptable...

Other than changing within the GUI or using tmsh in version 10.2.4 I don't think there is other options.

However in version 11.4 F5 introduced iCall, I would take a look and see if it looks like something that may be able to help you.

https://devcentral.f5.com/articles/icall-all-new-event-based-automation-system

That or iControl. Why can't the user have access, it's quite fine grained these days.

I know - it would be so easy if we could do it that way...but it involves security and a large global company, and a long story....I guess I'll go research iControl!

thanks

What determines the health and capacity of the old app? Is there a metric that can be remotely polled? If you can get that value, whatever it is, in an external monitor script, then you can dynamically change connection limit values for a given pool member.

As far as lowering the active connections. You could force offline the pool member to clear out the connections, but this will kill all connections. Merely disabling the pool member will not clear out active connections if I remember correctly.

Alternately in 10.2.4 you could list connections and selectively kill sessions or a number of sessions down to the new limit. This does require cli access though. "b conn help" will give you the syntax for deleting connections.

As Mike pointed out, those don't help in a situation where someone wanting to adjust the connections doesn't have GUI or CLI access. There aren't a whole lot of options. My recommendation would be to lower the connection limit to the minimum amount supported during a bad period on the server.

Alternately, the F5 might be able to help out the back-end server. The one-connect profile, and caching might be useful. Lowering the tcp-timeout might be useful in clearing out old connections more quickly if the client doesn't do it properly. If you lower the tcp-timeout below legitimate traffic you could worsen the issue.

just wondering if dynamic ratio load balance can help.

sol9125: Overview of Dynamic Ratio load balancing

As Kevin is alluding to, if there is some sort of data, stat, metric or anything else that the LTM could read/poll/look-up to determine if it needed to adjust the limit, this could be done within an iRule and be "set and forget", or near enough to not matter. If it is completely arbitrary, well, that's a bit more manual-user-interventiony, then.

Perhaps an SNMP poll to the server to see how the CPU/Memory is doing? A monitor set up on the LTM that flips under certain conditions? Something?

Just trying to exhaust options. :)