For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

NiHo_202842's avatar
NiHo_202842
Icon for Cirrostratus rankCirrostratus
Sep 14, 2016

Unusual high CPU cycles on iRule

Hi, So I am using the following iRule on all virtual servers & just enabled timing on this:

priority 50
when RULE_INIT {
        set static::maindatalist
        set static::debug 0
}
when HTTP_REQUEST {
         return the company logo from ifile
        if { ([HTTP::uri] eq "/bip-company-logo.gif") }{
                HTTP::respond 200 content [ifile get /Common/company-logo]
                return
        }

        set vs [virtual name]
        if {($static::debug == 1)}{ log local0. "VS is $vs, looking at $static::maindatalist" }
        set status [class match -value "[virtual name]" equals "maintenance-list"]
        if {($static::debug == 1)}{ log local0. "Looked up status: $status" }
        if { ($status eq "1") } {

                if { ([HTTP::uri] eq "/favicon.ico") }{
                        HTTP::respond 404 content ""
                        return
                }

                set contact "Application Support () or your Regional Helpdesk"
                if {([virtual name] starts_with "/ITSS/")}{
                        set contact "your Regional Helpdesk"
                }

                if {($static::debug == 1)}{ log local0. "Showing maintenance page" }
                HTTP::respond 200 content "

        
                
                Down for maintenance - company
        
        
                
                        
                                
                                Maintenance
                                
                                
                        
                        
                        
                        
                        
                                This application is currently undergoing maintenance.
                                It should be available again within the specified time period.
                        
                        
                        
                                For any questions, please contact $contact.
                        
                
        
" Connection Close
return
        }
}
when LB_FAILED {
        set contact "Application Support () or your Regional Helpdesk"
        if {([virtual name] starts_with "/ITSS/")}{
                set contact "your Regional Helpdesk"
        }

        HTTP::respond 503 content "

        
                
                
                Application Unavailable - company
        
        
                
                        
                                
                                Application unavailable
                                
                                
                        
                        
                        
                        
                        
                                This application is currently not available.
                                Please contact $contact.
                        
                
        
" Connection Close
return
}

(378 requests)

RULE_INIT: 5900 min, 12300 avg, 12300 max 
LB_FAILED: 46000 min, 60200 avg, 167000 max
HTTP_REQUEST: 21300 min, 44000 avg, 384900 max

I used the F5DevCentral_iRulesRuntimeCalculator to calculate the CPU usage, coming down to 28% max CPU usage per request. This seems VERY high. Is there anything I can do about this? I tested with a healthy node & a disabled node, no maintenance mode.

BIG-IP
cpu
devops
irule
iRules
optimization
performance
usage

1 Reply

  • Kai_Wilke's avatar
    Kai_Wilke
    Icon for MVP rankMVP
    Sep 15, 2016

    Hi NiHo,

    you should consider in your calculations how often each event is executed. 

    • RULE_INIT
      : Is only issued each time you load/save the config 
    • HTTP_REQUEST
      : Is issued on each request.
    • LB_FAILED
      : Is issued on each request, but only if the POOL has been failed and if 
      ( $status eq "1" )
      is not active.

    In addition, if 

    ( $status eq "1" )
    or your POOL is down, then you will send a HTTP response on behalf of your servers and save the ressources required to handle server side connections. I would bet that an outtage/maintenance will even result in a lower CPU consumption compared to normal operation.

    In the end just the 

    HTTP_REQUEST
    event should be considered in your calculation. The iRule you've provided is already highly optimized. You may only save a few cycles by removing the 
    $status
    variable and passing the results of 
    [class match -value "[virtual name]" equals "maintenance-list"]
    directly into the 
    if { } then {
    . But thats all about what you can do to further improve this iRule without over engineering it.

    Also keep in mind, that you've to multiply the Cycles/Sec value of the spreatsheet with the total number of CPU cores in your system.

    Cheers, Kai