Simple reversed http check

Question

Hi,&nbsp;As first, I am aware similar questions have been asked often and for years now. However, somehow the answers I found tusfar don't satisfy me, so I'll try my own question :-)&nbsp;We run hundreds of servers in big numbers of pools on our F5.  Our networking department disallows usage of api's, however they want to coöperate in the following:&nbsp;I need a a way to enable and disable poolmembers / nodes (will call all nodes from here) from a script or pipeline.So I set up a webserver and set up this idea:I define a healthcheck template that checks a page which is the nodename. If page is available, a status 200 is returned which is a sign to disable the node. When the page is absent, a 404 status is returned, which is a sign to enable the node. If anything else is returned also the node should be enabled.&nbsp;Now I would like to know if the nodename is available a as default variable for a monitor?&nbsp;If not, I need to define specific for each member, that is an awful lot of work. Would prefer to keep it general.&nbsp;Also, can I achieve this without using an external monitor? Since there are 100's of members, the extra resource penalty might add up.&nbsp;Thnx

simon_blakely · Answer

&gt; We run hundreds of servers in big numbers of pools on our F5. Our networking department disallows usage of api's, however they want to coöperate in the following:&nbsp;Using a script and the iControl RestAPI is by far the easiest way to control node availability.&nbsp;&gt; I define a healthcheck template that checks a page which is the nodename.&nbsp;You mean you have a single node that provides an appropriate response as to whether a specific node should be available or not? You would have to do that using a custom external monitor.&nbsp;If every node had a page (the same page on all nodes) that reported whether it should be enabled or disabled then it might be easier. &nbsp;K71282813: Overview of BIG-IP EAV external monitors&nbsp;&gt; Now I would like to know if the nodename is available a as default variable for a monitor?&nbsp;The NODE_NAME is set as an environmental variable for external monitors &nbsp;&gt; Also, can I achieve this without using an external monitor? Since there are 100's of members, the extra resource penalty might add up.&nbsp;Not the way you describe it, and yes - you would be running the external monitor for all nodes, which would be a real performance drain.&nbsp;If you had a standard http monitor that probed every node to flag whether is should be enabled or disabled, you could use the log messages (via alertd) to trigger an icall script that enables/disables the node.&nbsp;&nbsp;&nbsp;

tuckson · Answer

===&gt; You mean you have a single node that provides an appropriate response as to whether a specific node should be available or not? You would have to do that using a custom external monitor.===The whole idea relies on the use of healthchecks on the F5. There are different forms of health checks. The most basic one is just checking if a listener port is available.&nbsp;If not, node disabled. If so, node enabled.However a more advanced check is also possible in which a send string is defined en a receive string is captured which can be used to enable or disable a node. We want to make use of this feature.The idea is that every node in an F5 vip has 2 diffferent healthchecks.&nbsp;1) The regular Port availability check.Is the port down then the node must be disabled. If the port comes up, the node should be enabled after a little while.Suppose we have a VIP1, which contains 2 nodes, ServerA and ServerB (see picture below).Normally, ServerA and ServerB are running and the VIP is up. Whenever 1 of these 2 servers comes in trouble and the port is no longer available, the port availability check sees so and disables the node in VIP1.&nbsp;2) The http check.Inside the environment we run a webserver (listens on port 8000). Let's call it ServerX. This webserver bij default returns a 404 status (page not found) on every requestWhen we as engineers intentionally want to disable a node, we will let the webserver respond a status 200 to a request with the node's name.&nbsp;So per example:&nbsp;ServerA listening on port 8080 is placed in VIP1 on the F5 with 2 healtchecks. The port availability check and the http check. So is ServerBNow the port availabilty check just checks ServerA:8080The httpcheck however, sends it's request to http://serverX:8000/ServerA&nbsp;If a status 200 is returned, the F5 DISABLES ServerA in VIP1.&nbsp;&nbsp;If ANYTHING ELSE is returned the F5 ENABLES ServerA in VIP1.&nbsp;For ServerD in VIP2, the same principle goes. Suppose the server listens on port 51243Now the port availabilty check just checks ServerD:51243The httpcheck however, sends it's request to http://serverX:8000/ServerD&nbsp;If a status 200 is returned, the F5 DISABLES ServerD in VIP2.&nbsp;&nbsp;If ANYTHING ELSE is returned the F5 ENABLES ServerD in VIP2.&nbsp;&nbsp;The idea behind this reversed check (enabling on an error status) is that failures involving the webserver itselves should not lead to disabling nodes.&nbsp;Now, by being able to pass the nodename as a variable, there is no need to define the check specifically for each node. &nbsp;&nbsp;Ow, and I do not have acces to the restapi

simon_blakely · Answer

So ServerX:8000 is the node availability check - you probe serverX:8000 with the node-name to see if the node should be enabled or disabled.&nbsp;You would need a single external monitor applied to all the nodes that gets the NODE_NAME from the execution environment, and makes the probe, and then marks the node down based on the response code.&nbsp;Doable, but possibly a resource drag. I can't see a way to use a standard monitor to do this.

tuckson · Answer

OK.  Thnx. I was hoping that maybe a scripted monitor would be a possibility. But I read that Node_Name is available in external montors only anyway?&nbsp;

tuckson · Answer

OK, It's working with an external monitor now. Nice to know the principle works. However I'm still a bit worried about possible performance impact when using this on al larger scale. SO am looking for ways to use , for example, a scripted monitor. Soms some form of expect, so this could be an alternative. Do I have ip address of the node/poolmember available in there?

Forum Discussion

Simple reversed http check

Recent Discussions

AS3 Limitations

Diameter iRules attachment?

Help needed with iRule (connection closed log )

Use of SSL Decryption.

VLAN Failsafe Functionality

Related Content

Simple Reverse Proxy with iRules

Simple Sideband - iRule sideband the easy way

BIG-IP Solutions: Simple URL Redirects

Simple iRulesLX JSON rewrite

Making WAF Simple: Introducing the OWASP Compliance Dashboard

ABOUT DEVCENTRAL

RESOURCES

SUPPORT

PARTNERS