Forum Discussion
NimbostratusSSL monitor fails after hotfix
We have two F5 LTM's in a Sync-Failover pair. They're load balancing some critical production services. They are automatically sync'ed. I've just applied Hotfix 6.0.442 to the standby.
After the reboot, one of our services failed. The service that failed is a web (Apache/Tomcat). The health monitor for the service pool uses an https get to check the content of a web page. I've enabled monitor logging and the log shows
(_recv_active_service_ping): read failed [ addr=::ffff:xxx.xxx.xxx.xxx:443 srcaddr=::ffff:xxx.xxx.xxx.xxx%0:56209 ] 2015-12-08 17:17:03.843802: ID 560 :(_recv_active_service_ping): Response did not match recv regex yet [ addr=::ffff:xxx.xxx.xxx.xxx:443 srcaddr=::ffff:xxx.xxx.xxx.xxx%0:56209 ].
Trying to get the url from the command line using curl also fails with a certificate error so I'm assuming that this is causing the problem although this was working before the application of the hotfix.
So, I've got a couple of questions:
- The primary has not had the hotfix applied - would applying this to thwe standby cause anything to change on the primary?
- Has anyone experienced issues with SSl certificates and health monitors?
- Is there anything in the hotfix that could cause this?
I'm now a bit nervous about applying the hotfix to the primary and considering rolling back the secondary.
6 Replies
Brad_ParkerCirrus
Check your http and https monitors. There's a bug where when upgrading to 11.6.0 HF6 all the backslashes get escaped with another backslash in the http/s monitors which causes monitors to fail. You'll see stuff like
when your expecting it to be\\r\\n
. Just remove the extra backslashes and you should be good to go.\r\n
Martin_SharrattThanks Brad, that's fixed the problem. I'm still a little concerned about how this happened though. The standby is at HF6 but the primary is still at HF3. Should upgrading one of a pair cause the configuration to be changed? If so, is there a way to stop this happening?- Brad_ParkerAs soon as your standby syncs with the primary after rebooting those affected monitors will be updated on the primary as well. I would recommend turning off auto sync before you update the other device if it is on. After you reboot it do an overwrite config back to fix the broken monitors.
Brad_Parker_139Nacreous
Check your http and https monitors. There's a bug where when upgrading to 11.6.0 HF6 all the backslashes get escaped with another backslash in the http/s monitors which causes monitors to fail. You'll see stuff like
when your expecting it to be\\r\\n
. Just remove the extra backslashes and you should be good to go.\r\n- Martin_SharrattThanks Brad, that's fixed the problem. I'm still a little concerned about how this happened though. The standby is at HF6 but the primary is still at HF3. Should upgrading one of a pair cause the configuration to be changed? If so, is there a way to stop this happening?
- Brad_Parker_139As soon as your standby syncs with the primary after rebooting those affected monitors will be updated on the primary as well. I would recommend turning off auto sync before you update the other device if it is on. After you reboot it do an overwrite config back to fix the broken monitors.
