For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Ken_B_50116's avatar
Ken_B_50116
Icon for Cirrostratus rankCirrostratus
Jul 07, 2014

Reverse health monitor not working

I have this health monitor that works OK, but does not work when I 'reverse' it:

 

ltm monitor tcp TCP_port_1021 {
    defaults-from tcp
    description "Look for a string on port 1021"
    destination *:1021
    interval 5
    recv "Exclude from load balancing"
    time-until-up 0
    timeout 16
}

 

It works fine as written: If the server responds with "Exclude from load balancing" on port 1021, the monitor is green. If the monitor can't connect to port 1021, then the monitor goes red.

The problem is that if I set "Reverse" to "yes" in the health monitor, then the health monitor is always red, regardless of the server's response on port 1021. It should go green when there is no response on 1021, and red when there is a response on port 1021.

Why does the monitor not switch behavior when reverse is enabled? Is then some other way to accomplish having a monitor go red when the server responds on 1021?

application delivery
design
LTM

4 Replies

  • nitass's avatar
    nitass
    Icon for Employee rankEmployee
    Jul 08, 2014

    It should go green when there is no response on 1021

     

    i do not think so. if server does not respond (i.e. port is down), i understand reverse monitor will mark the server down.

     

    Is then some other way to accomplish having a monitor go red when the server responds on 1021?

     

    is receive disable string useful?

     

    sol12818: Using the Receive Disable String advanced configuration setting

     

    http://support.f5.com/kb/en-us/solutions/public/12000/800/sol12818.html

     

  • Ken_B_50116's avatar
    Ken_B_50116
    Icon for Cirrostratus rankCirrostratus
    Jul 08, 2014

    If a health monitor normally shows green when it connects on 1021, but then the monitor is reversed, then I thought it should be green if the LTM can NOT connect on 1021. Or, perhaps I do not fully understand how 'reverse' works.

     

    Yes, I could use a disable string, but this is not the preferred option because a Windows service is required to make the server listen on port 1021, and the server administrator does not want to have to run that service 100% of the time when the server is in production.

     

    The ideal configuration is to only run the Windows service (to serve on port 1021) when the server is to be taken out of the LTM pool for maintenance. This server (a Citrix server) does not have an HTTP server so I can't check for a receive or disable string on port 80, which would be ideal and easy for the server admin to edit/change via scheduled script.

     

  • nitass's avatar
    nitass
    Icon for Employee rankEmployee
    Jul 08, 2014

    The ideal configuration is to only run the Windows service (to serve on port 1021) when the server is to be taken out of the LTM pool for maintenance.

     

    in that case, i think external monitor script (e.g. return UP when no response and not return when there is response) may fit you more.

     

    LTM External Monitors: The Basics by Deb Allen

     

    https://devcentral.f5.com/articles/ltm-external-monitors-the-basics

     

  • Ken_B_50116's avatar
    Ken_B_50116
    Icon for Cirrostratus rankCirrostratus
    Jul 08, 2014

    Thanks for pointing me to the prospect of an external health monitor. With some learning and testing, I was able to accomplish my goal. I used the sample code in this article.

    Note that with LTM 11.x and higher, you create an external monitor differently than before. This article details the methods pre and post v11.

    I only had to make changes in 2 areas:

    Send the request request and check the response nc $IP $PORT | grep "my receive string" 2>&1 > /dev/null

    I changed the "my receive string" to the text the server returns. (The above line, for the folks who may be new to scripting and/or shell scripting, is the real heart of this script. It uses netcat (nc) to make a connection to the server's IP and port and look for a response. Note that you dont' change the $IP and $PORT text because those are variables which the script gets from the monitor configuration object. You can run NC from the LTM command line to see what it does.)

    Apparently with an External monitor, there is no "reverse" option. To compensate for this, I changed this line:

    if [ $? -eq 0 ]

    to this:

    if [ $? -ne 0 ]

    This changes "equals" to "not equals", so that if the script does find the expected string, then the health check fails. This gives the same effect as the reverse option. (This above line is the core element that determines if the health check fails or not. It's checking if the nc command returns a success (an error code "0", or yes/affirmative).

    So, thanks again for the assistance with this.