MySQL Monitor (or EAV) with SSL?

I will check the articles, thank you!

Yes, for the internal client I meant the one in /bin on the F5 itself:

root@my-f5-ltm:Active:Standalone] ~ # which mysql

/bin/mysql

And so nobody else has to flounder like I did, here is the script.

1. Import into File Management -> External Monitor Program File List
2. Create health monitor -> External
3. Set Interval and Timeout ( I am using 30/91)
4. Select the script you created in step 1
5. Add the following Variables
   1. Name: query , Value: select @@read_only;
   2. Name: result, Value: 0
   3. Name: pass, Value: <password here>

Value of 0 (zero) indicates Read/Write (Master) node, value of 1 (one) indicates read-only node.

Here is the script:

#!/bin/bash
 
# Name of the pidfile
pidfile="/var/run/$MONITOR_NAME.$1..$2.pid"
 
# Send signal to the process group to kill our former self and any children
# as external monitors are run with SIGHUP blocked
if [ -f $pidfile ]
then
   kill -9 -`cat $pidfile` > /dev/null 2>&1
fi
 
echo "$$" > $pidfile
 
# Remove the IPv6/IPv4 compatibility prefix
node_addr=`echo $1 | sed 's/::ffff://'`
 
# pass, query, and result are passed as variables
# from the Health Monitor definition
 
# Search the data received for the expected expression.
# Replace "<monitoring username here>" with the user you wish to log into mysql with
/bin/mysql -sN -u <monitoring username here> -p${pass} -h ${node_addr} -P $2 -e "${query}" 2> /dev/null | grep -E -i ${result} > /dev/null
 
status=$?
if [ $status -eq 0 ]
then
# Remove the pidfile before the script echoes anything to stdout and is killed by bigd
    rm -f $pidfile
    echo "up"
fi
 
# Remove the pidfile before the script ends
rm -f $pidfile

You may test MSSSQL as it has ssl support as per https://support.f5.com/csp/article/K40700745 .

Also enable debug as the error could be something else so check the monitor enable debug and read about mysql monitor issues in the bug tracker by searching with "mysql monitor":

https://support.f5.com/csp/article/K00170525

https://support.f5.com/csp/article/K12531

https://support.f5.com/csp/bug-tracker

It seems my instances need to allow more connections or something, after turning off the mysql monitor and leaving it for a while, I am able to connect using the mysql client found on the Bigip CLI. Copied up the CA, client cert, and client key, and can connect that way ..

Trying out the example from the MSSQL link you provided (using a dummy virtual server, and have the monitor point at that)

Ok, well.. The monitor using the Virtual as an alias doesn't work if the pool is down. If I add a simple ICMP monitor, and tell the pool to be up if at least 1 monitor succeeds, then the Virtual Server works. Problem is, it negates my use of the pool.

Only one of the mysql servers (3-node Enterprise cluster) will have the Master (read/write) role. I need one pool for read/write, and another for just the read-only nodes.

And manually updating the pools to enable/disable nodes is kind not what I want :)

SO - I will try using an external script, since I am able to use /bin/mysql to connect on the F5 CLI.

Looks like an external script did the trick. Still could not get the built-in mysql monitor to work, even with using the Virtual Server as the Alias.