Forum Discussion

pawel_jakacki_7's avatar
pawel_jakacki_7
Icon for Nimbostratus rankNimbostratus
Dec 04, 2012

Problem with IIS monitoring

Hello Guys,

 

 

I'm trying to write an IIS monitor. On IIS servers I have aspx script, which returns 0, when server works fine and other value if not. I've created HTTP monitor:

 

GET /IsAlive.aspx HTTP/1.1\r\nHost: www.test.com \r\nConnection: close\r\n\r\n

 

The problem is that F5 cannot see all returned content from server, but only header and the main html tags, but I must to check the output specified in the attached file

 

I've wrote an regexp, also present in the attached file

 

F5 cannot see above content even if I type "Status" (without question marks) in the Receive String field under the monitor configuration tab. The return page is quite small, Content Length has only 1966 bytes. The strange fact is that F5 can see the [Receive String field] <\/body>\r\n<\/html> tag, which is the last expression in the response.

 

Do you have any ideas how to fix it?

 

ps.I've heard that F5 has some limitation with checking payload (it checks only 4KB including scripts that are referenced in html).

 

 

Regards

 

Paul

 

config
design

18 Replies

Show More
  • nitass's avatar
    nitass
    Icon for Employee rankEmployee
    Dec 04, 2012
    can you try health monitor send string which is similar to the one in tcpdump (you know you can open tcpdump file with wireshark and copy request string)?
  • pawel_jakacki_7's avatar
    pawel_jakacki_7
    Icon for Nimbostratus rankNimbostratus
    Dec 04, 2012
    Yes, I had, the output is the following 

    15:44:42.673658 IP 10.x.X.201.43692 > 10.x.x.101.80: P 1:165(164) ack 1 win 115  out slot1/tmm0 lis=
        0x0000:  4500 00d8 e5ce 4000 4006 3d24 0a00 01c9  E.....@.@.=$....
        0x0010:  0a00 0165 aaac 0050 f1ea 8b1f 98ef 5a43  ...e...P......ZC
        0x0020:  8018 0073 2c46 0000 0101 080a 6654 7bc4  ...s,F......fT{.
        0x0030:  0000 0000 4745 5420 2f49 7341 6c69 7665  ....GET./IsAlive
        0x0040:  2e61 7370 7820 4854 5450 2f31 2e31 0d0a  .aspx.HTTP/1.1..
        0x0050:  5573 6572 2d41 6765 6e74 3a20 6375 726c  User-Agent:.curl
        0x0060:  2f37 2e31 392e 3720 2869 3638 362d 7265  /7.19.7.(i686-re
        0x0070:  6468 6174 2d6c 696e 7578 2d67 6e75 2920  dhat-linux-gnu).
        0x0080:  6c69 6263 7572 6c2f 372e 3139 2e37 204f  libcurl/7.19.7.O
        0x0090:  7065 6e53 534c 2f30 2e39 2e38 7520 7a6c  penSSL/0.9.8u.zl
        0x00a0:  6962 2f31 2e32 2e33 206c 6962 6964 6e2f  ib/1.2.3.libidn/
        0x00b0:  302e 362e 350d 0a48 6f73 743a 2031 302e  0.6.5..Host:.10.
        0x00c0:  302e 312e 3130 310d 0a41 6363 6570 743a  x.x.101..Accept:
        0x00d0:  202a 2f2a 0d0a 0d0a 0105 0100 0000 00    .*/*...........
15:44:42.675260 IP 10.x.x.101.80 > 10.x.x.201.43692: . 1:1449(1448) ack 165 win 64076  in slot1/tmm0 lis=
        0x0000:  4500 05dc 62b5 4000 8006 7b39 0a00 0165  E...b.@...{9...e
        0x0010:  0a00 01c9 0050 aaac 98ef 5a43 f1ea 8bc3  .....P....ZC....
        0x0020:  8010 fa4c fe9f 0000 0101 080a 06a2 48b0  ...L..........H.
        0x0030:  6654 7bc4 4854 5450 2f31 2e31 2032 3030  fT{.HTTP/1.1.200
        0x0040:  204f 4b0d 0a44 6174 653a 2054 7565 2c20  .OK..Date:.Tue,.
        0x0050:  3034 2044 6563 2032 3031 3220 3134 3a34  04.Dec.2012.14:4
        0x0060:  343a 3434 2047 4d54 0d0a 5365 7276 6572  4:44.GMT..Server
        0x0070:  3a20 4d69 6372 6f73 6f66 742d 4949 532f  :.Microsoft-IIS/
        0x0080:  362e 300d 0a58 2d50 6f77 6572 6564 2d42  6.0..X-Powered-B
        0x0090:  793a 2041 5350 2e4e 4554 0d0a 582d 4173  y:.ASP.NET..X-As
        0x00a0:  704e 6574 2d56 6572 7369 6f6e 3a20 322e  pNet-Version:.2.
        0x00b0:  302e 3530 3732 370d 0a53 6574 2d43 6f6f  0.50727..Set-Coo
        0x00c0:  6b69 653a 2041 5350 2e4e 4554 5f53 6573  kie:.ASP.NET_Ses
        0x00d0:  7369 6f6e 4964 3d67 3562 7132 6435 3578  sionId=g5bq2d55x
        0x00e0:  6667 7733 3334 3535 6177 3369 756a 6e3b  fgw33455aw3iujn;
        0x00f0:  2070 6174 683d 2f3b 2048 7474 704f 6e6c  .path=/;.HttpOnl
        0x0100:  790d 0a43 6163 6865 2d43 6f6e 7472 6f6c  y..Cache-Control
        0x0110:  3a20 7072 6976 6174 650d 0a43 6f6e 7465  :.private..Conte
        0x0120:  6e74 2d54 7970 653a 2074 6578 742f 6874  nt-Type:.text/ht
        0x0130:  6d6c 3b20 6368 6172 7365 743d 7574 662d  ml;.charset=utf-
        0x0140:  380d 0a43 6f6e 7465 6e74 2d4c 656e 6774  8..Content-Lengt
        0x0150:  683a 2031 3935 310d 0a0d 0a0d 0a0d 0a3c  h:.1951........<
        0x0160:  2144 4f43 5459 5045 2068 746d 6c20 5055  !DOCTYPE.html.P
  • nitass's avatar
    nitass
    Icon for Employee rankEmployee
    Dec 04, 2012
    please, find the wireshark output in the attachment. Can you see it?no, i do not see any attachment.

     

     

    can you open 2 SSH sessions? one is curl and the other one is ssldump (ssldump -Aed -nni 0.0 host 10.x.x.101 and port 80).
  • pawel_jakacki_7's avatar
    pawel_jakacki_7
    Icon for Nimbostratus rankNimbostratus
    Dec 04, 2012
    yes, curl returns correct value

     

    
HTTP/1.1 200 OK
Date: Tue, 04 Dec 2012 15:21:34 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
Set-Cookie: ASP.NET_SessionId=qoh51h55bxp2hv55gpzyamug; path=/; HttpOnly
Cache-Control: private
Content-Type: text/html; charset=utf-8
Content-Length: 1951








    


    


        Status
        
            0

     

     

    but in ssldump I'm receiving HTTP 500

     

     

    
1354634497.7469 (0.0013)  S>C
---------------------------------------------------------------
HTTP/1.1 500 Internal Server Error
Connection: close
Date: Tue, 04 Dec 2012 15:21:40 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
Cache-Control: private
Content-Type: text/html; charset=utf-8
Content-Length: 3565


    
        Object reference not set to an instance of an object.
        
    

    

            Server Error in '/' Application.

             Object reference not set to an instance of an object. 

            

      ---------------------------------------------------------------

1354634497.7470 (0.0000)  S>C
---------------------------------------------------------------
       Description: An unhandled exception occurred during the execution of the current web request. Please review the stack trace for more information about the error and where it originated in the code.

     

     

    The same output as in ssldump I've received when used telnet 10.x.x.101 80 and typed GET /IsAlive.aspx
  • nitass's avatar
    nitass
    Icon for Employee rankEmployee
    Dec 04, 2012
    can you try this? please correct ip address in host header. 

    GET /IsAlive.aspx HTTP/1.1\r\nUser-Agent: curl/7.19.7 (i686-redhat-linux-gnu) libcurl/7.19.7 OpenSSL/0.9.8u zlib/1.2.3 libidn/0.6.5\r\nHost: 10.x.x.101\r\nAccept: */*\r\n\r\n
  • pawel_jakacki_7's avatar
    pawel_jakacki_7
    Icon for Nimbostratus rankNimbostratus
    Dec 04, 2012
    Posted By nitass on 12/04/2012 07:30 AM

    can you try this? please correct ip address in host header.

    GET /IsAlive.aspx HTTP/1.1\r\nUser-Agent: curl/7.19.7 (i686-redhat-linux-gnu) libcurl/7.19.7 OpenSSL/0.9.8u zlib/1.2.3 libidn/0.6.5\r\nHost: 10.x.x.101\r\nAccept: */*\r\n\r\n

    Now I can see the proper output in tcpdump either ssldump. Now the only thing that I should have to do is correct the regexp, because previous one does not work.

    Nitass, thank you for help!!

  • pawel_jakacki_7's avatar
    pawel_jakacki_7
    Icon for Nimbostratus rankNimbostratus
    Dec 04, 2012
    This regexp works fine 

    
Status\s*\s*0\s*

    many thanks again Nitass for your help

    Regards

    Paul