Configuring Decision Logging for the F5 BIG-IP Global Traffic Manager

I was working on a GTM solution and with my limited lab I wanted to make sure that the decisions that F5 BIG-IP Global Traffic Manager made at the wideIP and pool level were as evident in the logs as they were consistent in my test results. It turns out there are some fancy little checkboxes in the wideIP configuration that you can check to enable such logs.

You might notice, however, that upon enabling these checkboxes the logs are nowhere to be found. This is because there are other necessary steps. You need to configure a few objects to get those logs flowing.

Log Publisher

The first object is the log publisher. For as much detail as flows in the decision logging, I’d highly recommend using an HSL profile to log to a remote server, but for the purposes of testing I used the local syslog.

This can also be done with tmsh.

sys log-config publisher gtm_decision_logging {
    destinations {
        local-syslog { }
    }
}

DNS Logging Profile

Next, create a DNS logging profile, make sure to select the Log Publisher you created in the previous step. For testing purpose I enabled the log responses and query ID as well, but those are disabled by default.

This also can be created in tmsh.

ltm profile dns-logging gtm_decision_logging {
    enable-response-logging yes
    include-query-id yes
    log-publisher gtm_decision_logging
}

Custom DNS Profile 

Now create a custom DNS profile. The only custom properties necessary are at the bottom of the profile where you enable logging and select the logging profile.

This can also be configured in tmsh.

ltm profile dns gtm_decision_logging {
    app-service none
    defaults-from dns
    enable-logging yes
    log-profile gtm_decision_logging
}

Apply the DNS Profile

Now that all the objects are created, you can reference the DNS profile in the listener.

in tmsh, you can modify the listener by adding the profile or if one already exists, replacing it.

modify gtm listener gtmlistener profiles replace-all-with { udp_gtm_dns gtm_decision_logging }

Log Details

Once you have all the objects configured and the DNS profile referenced in your listener, the logging should be hitting /var/log/ltm now. For this first query, the emea pool is selected, but there is no probe data for my primary load balancing method, and the none alternate method skips to the fallback, which uses the configured fallback IP to respond to the client.

2015-06-03 08:54:21 ltm1.dc.test qid 11139 from 192.168.102.1#64536: view none: query: my.example.com IN A + (192.168.102.5%0)

2015-06-03 08:54:21 ltm1.dc.test qid 11139 from 192.168.102.1#64536 [my.example.com A]
[round robin selected pool (emea)]
[pool member check succeeded (vip3:192.168.103.12) - pool member state is available (green)]
[QoS skipped pool member (vip3:192.168.103.12) - path has unmeasured RTT]
[pool member check succeeded (vip4:192.168.103.13) - pool member state is available (green)]
[QoS skipped pool member (vip4:192.168.103.13) - path has unmeasured RTT]
[failed to select pool member by preferred load balancing method]
[Using none load balancing method]
[failed to select pool member by alternate load balancing method]
[selected configured fallback IP]

2015-06-03 08:54:21 ltm1.dc.test qid 11139 to 192.168.102.1#64536: [NOERROR qr,aa,rd] response: my.example.com. 30 IN A 192.168.103.99;

In this second request, the emea pool is again selected, but now there is probe data, so the pool member is selected as appropriate.

2015-06-03 08:55:43 ltm1.dc.test qid 6201 from 192.168.102.1#61503: view none: query: my.example.com IN A + (192.168.102.5%0)

2015-06-03 08:55:43 ltm1.dc.test qid 6201 from 192.168.102.1#61503 [my.example.com A]
[round robin selected pool (emea)]
[pool member check succeeded (vip3:192.168.103.12) - pool member state is available (green)]
[QoS selected pool member (vip3:192.168.103.12) - QoS score (2082756232) is higher]
[pool member check succeeded (vip4:192.168.103.13) - pool member state is available (green)]
[QoS skipped pool member (vip4:192.168.103.13) from two pool members with equal scores]
[QoS selected pool member (vip3:192.168.103.12)]

2015-06-03 08:55:43 ltm1.dc.test qid 6201 to 192.168.102.1#61503: [NOERROR qr,aa,rd] response: my.example.com. 30 IN A 192.168.103.12;

In this final request, the americas pool is selected, but there is no valid topology score for the pool members, so query is refused.

2015-06-03 08:55:53 ltm1.dc.test qid 23580 from 192.168.102.1#59437: view none: query: my.example.com IN A + (192.168.102.5%0)

2015-06-03 08:55:53 ltm1.dc.test qid 23580 from 192.168.102.1#59437 [my.example.com A]
[round robin selected pool (americas)]
[pool member check succeeded (vip1:192.168.103.10) - pool member state is available (green)]
[QoS selected pool member (vip1:192.168.103.10) - QoS score (0) is higher]
[pool member check succeeded (vip2:192.168.103.11) - pool member state is available (green)]
[QoS skipped pool member (vip2:192.168.103.11) from two pool members with equal scores]
[QoS selected pool member (vip1:192.168.103.10)]
[topology load balancing method failed to select pool member (vip1:192.168.103.10) - topology score is 0]
[failed to select pool member by preferred load balancing method]
[selected configured option Return To DNS]

2015-06-03 08:55:53 ltm1.dc.test qid 23580 to 192.168.102.1#59437: [REFUSED qr,rd] response: empty

Yeah, yeah, skip all that and give me the good stuff

If you want to test it quickly, you can save the config below to a file (/var/tmp/gtmlogging.txt in this example) and then merge it in. Finally, modify the wideIP and listener and you’re good to go!

###
### configuration: /var/tmp/gtmlogging.txt
###
sys log-config publisher gtm_decision_logging {
    destinations {
        local-syslog { }
    }
}
ltm profile dns-logging gtm_decision_logging {
    enable-response-logging yes
    include-query-id yes
    log-publisher gtm_decision_logging
}
ltm profile dns gtm_decision_logging {
    app-service none
    defaults-from dns
    enable-logging yes
    log-profile gtm_decision_logging
}

###
### Merge Command
###
tmsh load sys config merge file /var/tmp/gtmlogging.txt

###
### Modify wideIP and Listener
###
tmsh modify gtm wideip my.example.com load-balancing-decision-log-verbosity { pool-member-selection pool-member-traversal pool-selection pool-traversal }
tmsh modify gtm listener gtmlistener profiles replace-all-with { udp_gtm_dns gtm_decision_logging }
tmsh save sys config