Forum Discussion

Muhammad_Irfan1's avatar
Muhammad_Irfan1
Icon for Cirrus rankCirrus
Feb 28, 2015

Pool members goes down where as application is running

We are facing a problem.

 

There are about 40 pools defined in LTM and each have 2 or 3 members. All of them are monitored on TCP-halfopen monitor which monitors pool members on the bases of TCP port.

 

Only 1 pool which have 3 members goes down up down up simultaneously after one two days. Not one member but all three. I get informed by email notifications. But Application experts handling servers says that application is running and it didn't stopped at that time.

 

Now i am confused why only this one pool goes down and gives fake alarms? Or its possible that application is running but as this application have a lot of load now a days that is why it doesn't respond to monitoring of F5 that is why F5 mark it down?

 

1 Reply

  • StephanManthey's avatar
    StephanManthey
    Icon for Nacreous rankNacreous
    Feb 28, 2015

    Hi Muhammad,

    this pool is monitored as well via tcp_half_open only, if I understood your question right.

    You can see the pool member toggling as well in /var/log/ltm?

    I would recommend to run a trace while observing the issue: 
    tcpdump -nnni 0.0 -s 0 -e 'host  and (host  or host )'

    Just replace "bigip_self_ip" with the serverside self IP of the BIG-IP you are running the trace on (as it is used for healthchecking) and the "node_0(1|2)" by the pool member IPs.

    The tcp_half_open should show a SYN sent by BIG-IP, SYN-ACK response from node, followed by RESET from the BIG-IP.

    Perhaps your server folks are running an IDS/IPS?

    Did you already try to use an increased monitoring interval?

    I would be interested in your findings. What TMOS version are you on?

    Thanks, Stephan