For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Generate qkview on core dump or unknown restart

Problem this snippet solves:

This iCall script is a demo showing how a perpetual iCall handler can be used to watch for changes to the contents of the directory used to store core files (created when BIG-IP daemons unexpectedly exit), and upon seeing a new or modified entry, collecting a diagnostic snapshot of the system.

How to use this snippet:

Implementation Details

This iCall script requires v11.4 or higher.

Code :

### start code ###
sys icall script core_restart_watch {
    app-service none
    definition {
        # prime the array with existing cores so the initial run won't generate
        # qkviews
        foreach { file } [glob /var/core/*.gz] {
            file stat $file corestat
            set cores($file) $corestat(mtime)
        }

        # main loop
        while { 1 } {
            foreach { file } [glob /var/core/*.gz] {
                file stat $file corestat
                # act if an entry doesn't already exist (indicating new core),
                # or if one exists but has a different modification time
                # (indicating an overwritten corefile)
                if { ! [info exists cores($file)] || $cores($file) ne $corestat(mtime) } {
                    # insert/update this core for future use
                    set cores($file) $corestat(mtime)

                    # name the qkview after the hostname and date+time
                    set date [clock format [clock seconds] -format "%Y%m%d%H%M%S"]
                    set settings [tmsh::get_config sys global-settings]
                    set host [tmsh::get_field_value [lindex $settings 0] hostname]

                    # generate a UCS at this time
                    puts "core found ($file), collecting diagnostic data as: /var/tmp/${host}-${date}.ucs"
                    exec tmsh save sys config file /var/tmp/${host}-${date}.ucs
                    
                    # no need to run for more than one core
                    break
                }
            }
            # time in ms to wait between this running
            after 30000
        }
    }
    description none
    events none
}

### end code ###

And the following perpetual handler to run it:

### start code ###
handler perpetual core_restart_watch 
sys icall handler perpetual core_restart_watch {
    script core_restart_watch
}
### end code ###
Published Mar 09, 2015
Version 1.0
No CommentsBe the first to comment