For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

KeyPat_152122's avatar
KeyPat_152122
Icon for Nimbostratus rankNimbostratus
Jul 29, 2014

trying to capture 5XX HTTP response and retry to another pool member - passive monitor

I am running LTM 11.4 and trying to capture HTTP response 5XX using below irule. I am trying to log on finding 5XX status code. I do not see any thing in the logs. The irule is being hit as it does execute log local0.info "Run $retry". It is a HTTPS connection client SSL -> F5 -> server SSL. Am I missing any thing for this to work?

 

Retry 400/500 Errors
  CPU impact:   Low
  Requirement:  HTTP profile

  When a 400/500 is returned from the server the LTM will try
  resending to request to every member in the pool. Any time a
  request is retry the LTM will clear out the retry variable after
  the count has gone over the limit, or when a non 400/500 status is return
  This will allow the next request to be able to use the resend iRule also.

when CLIENT_ACCEPTED {
    set retry 0
}

when HTTP_REQUEST {
    set http_request [HTTP::request]
}

    when HTTP_RESPONSE {
    if { ([HTTP::status] starts_with "5")} {
        log local0.info "found 500" 
        incr retry
        if { $retry <= [active_members [LB::server pool]] } {
            HTTP::retry $http_request
        } else {
            set retry 0
        }  

    } else {
        set retry 0
    }
}

when LB_SELECTED {
    log local0.info "Run $retry"
    if { ($retry > 0) && ($retry <= [active_members [LB::server pool]])} {
        LB::reselect pool [LB::server pool]
    }
}

4 Replies

  • I would probably start with some additional logging:

    when HTTP_REQUEST {
        log local0. "Request URI: [HTTP::uri]"
        set http_request [HTTP::request]
    }
    when HTTP_RESPONSE {
        log local0. "Response status: [HTTP::status]"
        if { ( [HTTP::status] starts_with "5" ) } {
            ...
        }
    }
    

    This will at least prove that the HTTP events are being triggered and what they're being triggered for.

  • Thanks Kevin,

     

    It is logging HTTP_REQUEST but I am not seeing HTTP::status

     

    That means it is not executing - when HTTP_RESPONSE { log local0. "Response status: [HTTP::status]" if { ( [HTTP::status] starts_with "5" ) } { ... }

     

    Do you see any thing wrong there?

     

  • So just to be clear, are you saying that you don't see ANY response event logs? Do you this thing configured for direct server return (around the F5)? Does the application work at all?

     

  • The issue is resolved. It was our development team trying to generate 500 error by taking the app server offline. Thus F5 was not getting HTTP status back from server. We thought that client is getting 500 but it was sent from LTM. Thanks for your help.