For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

abhy201's avatar
abhy201
Icon for Nimbostratus rankNimbostratus
Sep 25, 2018

Pool member down due to no Ping response

Hello,   Below is the Monitor log for a pool member which shows down. The pool member is another Vserver which is active and gives a successful ping when I do it directly from cmd line.   The ...
BIG-IP
cloud
devops
LTM
rluhrman_127985's avatar
rluhrman_127985
Historic F5 Account
Sep 25, 2018

The logs is misleading. Ping really means request... if you do the same for an HTTP monitor it doesn't state "Request Sent" is states (_do_ping) etc.

 

Can you do a "tmsh list ltm monitor (monitor name)" for output for the monitor that is failing?

 

Also try using either telnet or socat to connect to the IP:PORT combination instead of using ICMP, which goes as far as layer 3, while your monitor should test all the way to layer 7.

 

rluhrman_127985's avatar
rluhrman_127985
Historic F5 Account
Sep 25, 2018

A tcpdump of the interactions between bigd (the daemon that does the health check communication) and the node would help as the communication can technically fail at multiple levels of the OSI model.

 

I noticed that your receive string would accept a 404 as a valid response. Usually that would indicate that a resource being queried is not available, but the monitor would mark it up even if the resource was not found.

 

For the tcpdumps, looking at both the traffic between Bigd and TMM, and TMM to the node may help to determine what is happening.

 

For the traffic between tmm and bigd, use "tcpdump -ni :nnnh -s0 -w /var/tmp/$(hostname)_<vlan_name>.pcap host (ip address of node> and port

 

For the traffic between tmm and the node use "tcpdump -ni 0.0:nnn -s0 -w /var/tmp/$(hostname)_tmm.pcap host (ip address of node> and port

 

Run those concurrently.

 

You should open a support ticket for the tcpdump analysis by a Network Support Engineer. Be sure the generate a qkview after running the tcpdumps and provide that as well.