Montoring https port in windows server 2012 is not working with F5

There's SOL12531 that talks about monitors a little bit, and then this article that adds a little extra information.

Whenever I'm having monitor issues, I try a couple different things.

1:

I try to do a

curl

from the F5 CLI to verify that the url I'm trying to monitor is working properly and the response is coming back as expected.

2:

Turn on monitor debugging for the member and check the log that gets created. Those steps are as follows:

• Open the pool that is having the problem (let's call it MY_POOL)
• Make sure the monitor is active on the pool (let's call it MY_MONITOR)
• On the

  Members

  tab in the pool settings, click on one of the members (let's call it 10.0.0.1:3389)
• Enable the checkbox for

  Monitor Logging

  • Open an SSH session (I use Putty to connect) to the device and log in to the shell.
  • Run the command

    cd /var/log/monitors

  • Run the command

    ls -l

  • Look for the file referencing your pool and member (most likely in our example it'd be something like

    _Common_MY_MONITOR__Common_10.0.0.1_3389.log

    )
  • Run the command

    tail -f FILENAME

    (where FILENAME is the log filename)
  • It may be visible immediately, but you should see where the monitor sends the request to the server (and you'll see the

    send

    string), and you're looking for the

    recv

    string that comes back.
  • Take that

    recv

    string and update the monitor and see if the pool member(s) show up green again.
• Go back in and disable the monitor logging for that member so you don't have excessive logging filling up space.

Hopefully, this will help figure it out. If your log file ever looks like it's not updating, delete the lo file and remove the monitor from the pool and re-add it. I've found that will kick it back off again.

Hope this helps.

Hi midhun,

in addition to Michael´s detailed answer I would also consider the server expects a request via TLS with SNI (server name indication).

There is an article with description of an external monitor using openssl s_client here on DevCentral.

You can validate it from CLI by using the following syntax:

openssl s_client -connect : -servername  -quiet  

Now openssl establishes a connection using TLS with SNI attribute and you can paste in a valid request followed by two Carriage Return / New Lines (aka Enter):

GET / HTTP/1.1
Host: 
Connection: close
  

I had to use the described solution in a customer´s SharePoint environment and just added the ability to work in route domains. It works great on v11.5.1 since a couple of months.

Thanks, Stephan