Rule for debugging, logging LTM errors

There isn't currently an iRules command that allows you to log only during error states. You could certainly use an iRule to log the information you're looking for but, as you alluded to, it would be for every connection.

 

 

Colin

That is unfortunate..

 

 

I did write an inbound & outbound header logging rule. For the benefit of others I will post it here.

 

 

 

But it looks like I'll have to manually enable this rule when the errors start up & then sift through all the headers manually to look for anomalies?

 

 

 

 

 

 

 

INBOUND HEADER DUMP

 

 

 

when HTTP_REQUEST {

 

set headers [HTTP::header names]

 

set client [IP::client_addr]

 

set vip [IP::local_addr]:[TCP::local_port]

 

log local0. "HTTP_header_DUMP_BEGIN: Client: $client URL: [HTTP::host] [HTTP::uri] VIP: $vip"

 

foreach header_name $headers {

 

 

log local0. "HTTP_header_DUMP $client: $header_name: [HTTP::header $header_name] ([string length [HTTP::header $header_name]]) "

 

}

 

 

}

 

 

 

 

 

 

 

 

 

OUTBOUND HEADER DUMP

 

 

when HTTP_RESPONSE {

 

set headers [HTTP::header names]

 

set client [IP::client_addr]

 

set vip [IP::local_addr]:[TCP::local_port]

 

set node [IP::server_addr]:[TCP::server_port]

 

log local0. "HTTP_OUTBOUND_header_DUMP_BEGIN: Client: $client NODE: $node"

 

foreach header_name $headers {

 

 

log local0. "HTTP_OUTBOUND_header_DUMP $client: $header_name: [HTTP::header $header_name] ([string length [HTTP::header $header_name]]) "

 

}

 

 

}

 

 

 

 

 

 

Still better than TCPDump I guess, but it's going to be a pain .....

 

 

That error message means that one of your HTTP servers sent the BIG-IP data when the BIG-IP wasn't expecting any. There are two likely causes for that: one is that the server simply is sending extra data after its response (possibly due to an incorrect Content-Length header or invalid chunking), and the other is that you're using OneConnect and the server is timing out and sending a 408 response. Hope this helps.

1) Did you ever get anywhere with trying to locate the source that causes this error to be generated?

 

 

2) I like the iRule you made above but where did you apply it? I mean you can only apply iRules to Virtual Servers but if you don't have any clue (as in my case) who is triggering the log message then how do you know which Virtual Server to apply it to?

 

 

Thanks,

Posted By pskerrett on 09/17/2007 9:37 AM

 

Hello,

 

I've recently started getting periodic bursts of the following errors on my BigIP in the LTM log:

 

tmm tmm[9257]: 011f0007:3: http_process_state_prepend - Invalid action EV_INGRESS_DATA during ST_HTTP_PREPEND_HEADERS

 

These bursts start randomly & continue for an hour or so & then disappear. I would like to figure out what is happening.

 

It would be great if there were a way to run an iRule to capture the HTTP header & client source IP and log it each time the LTM gets this error.

 

Does anyone know if this is possible? I'd prefer to log only when the error occurs, instead of doing a huge TCPdump & capturing everything.

 

Thanks.