# HTTPS Monitor Health - Receive String 200 OK Not Working **URL:** \ **Category:** Technical Forums\ **Tags:** monitors\ **Created:** [November 7, 2024, 1:13am UTC](https://community.f5.com/t/https-monitor-health-receive-string-200-ok-not-working/75373 "2024-11-07T01:13:10Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![Netmart](https://avatars.discourse-cdn.com/v4/letter/n/9e8a1a/32.png) [@Netmart](https://community.f5.com/u/Netmart)\ **Post date:** [November 7, 2024, 1:13am UTC](https://community.f5.com/t/https-monitor-health-receive-string-200-ok-not-working/75373/1 "2024-11-07T01:13:10Z")
Hello, Though we receive in https response header “HTTP/1.1 200 OK”, the same string used as receive in Health Monitor does not work. F5 seems to ignore any character after HTTP/1.1. In sum: Not Working:                     HTTP/1.1 200 OK                     HTTP/1.1\s200                     HTTP/1\.(0|1)                     HTTP/1\.(0|1) (200)                     HTTP/1\.(0|1)\s200                     HTTP/1.1 200 OK                     HTTP/1.1\s200\sOK                     200 Only Working:                     ==\> HTTP/1.1                      ==\> OK||200                     ==\> \ Type: https, Alias Service port 443. VIP is using TCP profile. Extract from openssl capture : ---     HTTP/1.1 200 OK     Date: Wed, 06 Nov 2024 23:52:28 GMT     Content-Type: application/json; charset=UTF-8     Content-Length: 153     Connection: close     X-Krakend: Version 2.2.0     X-Krakend-Completed: false     X-Processing-Time: 0.000029     X-Request-Id: e187dac8-20f7-43fd-b99a-6e4671b7f8e6     Expires: Wed, 06 Nov 2024 22:52:28 GMT     Cache-Control: no-cache     X-Frame-Options: DENY     Strict-Transport-Security: max-age=31536000; includeSubdomains; preload     X-XSS-Protection: 1; mode=block     Client-Verify: NONE     X-Content-Type-Options: nosniff     X-Permitted-Cross-Domain-Policies: none     Feature-Policy: geolocation ‘none’; camera ‘none’; speaker ‘none’; microphone ‘none’;     Referrer-Policy: strict-origin-when-cross-origin     Expect-CT: enforce, max-age=72000     Content-Security-Policy: default-src ‘self’ blob:;base-uri ‘self’; form-action ‘self’; frame-ancestors ‘self’; script-src ‘self’; style-src ‘self’ ‘unsafe-inline’; font-src ‘self’ data:; object-src ‘none’; img-src ‘self’ data:;     Cache-Control: no-store closed ---
**Author:** ![Paulius](https://d1p9zq3aats0t8.cloudfront.net/user_avatar/community.f5.com/paulius/32/21698_2.png) [@Paulius](https://community.f5.com/u/Paulius)\ **Post date:** [November 7, 2024, 4:54am UTC](https://community.f5.com/t/https-monitor-health-receive-string-200-ok-not-working/75373/2 "2024-11-07T04:54:49Z")
@Netmart It doesn’t seem as though you tried the following, which should be the correct syntax. HTTP/1\.1 200 OK ---
**Author:** ![akonu](https://avatars.discourse-cdn.com/v4/letter/a/65b543/32.png) [@akonu](https://community.f5.com/u/akonu)\ **Post date:** [November 7, 2024, 1:02pm UTC](https://community.f5.com/t/https-monitor-health-receive-string-200-ok-not-working/75373/3 "2024-11-07T13:02:16Z")
@Netmart The HTTP monitor, include a  **Receive String** field. This field specifies a string for comparison with the server response. The health monitors that support regular expressions are HTTP, HTTPS, TCP, and UDP. In some cases, the string **200 OK** works as most servers respond with this status code. I found an article that could help answer your question on our \MyF5\ portal, please click on the links below K5917: Using regular expressions in a health monitor receive string > **[myF5](https://my.f5.com/manage/s/article/K5917)** I hope this helps. ---
**Author:** ![Netmart](https://avatars.discourse-cdn.com/v4/letter/n/9e8a1a/32.png) [@Netmart](https://community.f5.com/u/Netmart)\ **Post date:** [November 7, 2024, 3:32pm UTC](https://community.f5.com/t/https-monitor-health-receive-string-200-ok-not-working/75373/4 "2024-11-07T15:32:06Z")
Thank you Akonu. I am aware of this document and tried the following without any progress: Receive String: HTTP/1.1 200 OK  Not Working:HTTP/1.1 200 OKHTTP/1.1\s200HTTP/1\.(0|1)HTTP/1\.(0|1) (200)HTTP/1\.(0|1)\s200HTTP/1.1 200 OKHTTP/1.1\s200\sOK200 Only Working:==\> HTTP/1.1 ==\> OK||200==\> \ And I verified via curl/openssl the HTTPS Response header: HTTP/1.1 200 OK:--- **HTTP/1.1 200 OK** Date: Wed, 06 Nov 2024 23:52:28 GMTContent-Type: application/json; charset=UTF-8Content-Length: 153Connection: closeX-Krakend: Version 2.2.0X-Krakend-Completed: falseX-Processing-Time: 0.000029X-Request-Id: e187dac8-20f7-43fd-b99a-6e4671b7f8e6Expires: Wed, 06 Nov 2024 22:52:28 GMTCache-Control: no-cacheX-Frame-Options: DENYStrict-Transport-Security: max-age=31536000; includeSubdomains; preloadX-XSS-Protection: 1; mode=blockClient-Verify: NONEX-Content-Type-Options: nosniffX-Permitted-Cross-Domain-Policies: noneFeature-Policy: geolocation ‘none’; camera ‘none’; speaker ‘none’; microphone ‘none’;Referrer-Policy: strict-origin-when-cross-originExpect-CT: enforce, max-age=72000Content-Security-Policy: default-src ‘self’ blob:;base-uri ‘self’; form-action ‘self’; frame-ancestors ‘self’; script-src ‘self’; style-src ‘self’ ‘unsafe-inline’; font-src ‘self’ data:; object-src ‘none’; img-src ‘self’ data:;Cache-Control: no-store {“status”:“starting”,“services”:[{“name”:“nae-kmip”,“status”:“started”}],“messages”:[“all services ok, waiting 1m0s for services to continue to be ok”]}closed Thanks ---
**Author:** ![akonu](https://avatars.discourse-cdn.com/v4/letter/a/65b543/32.png) [@akonu](https://community.f5.com/u/akonu)\ **Post date:** [November 7, 2024, 5:33pm UTC](https://community.f5.com/t/https-monitor-health-receive-string-200-ok-not-working/75373/5 "2024-11-07T17:33:23Z")
@Netmart From your update, you said the 200 does not work. if that is the case, your server could be responding to the health probes with a different status code other than 200. Can I ask that you verify the output of the monitor using the guide below.( please use the same string as the monitor send string) K81239024: Testing HTTP/HTTPS Monitor Send String using openssl s\_client and netcat (nc) > **[myF5](https://my.f5.com/manage/s/article/K81239024)** Hope this helps. ---
**Author:** ![Netmart](https://avatars.discourse-cdn.com/v4/letter/n/9e8a1a/32.png) [@Netmart](https://community.f5.com/u/Netmart)\ **Post date:** [November 8, 2024, 12:44am UTC](https://community.f5.com/t/https-monitor-health-receive-string-200-ok-not-working/75373/6 "2024-11-08T00:44:58Z")
Thank you again. We continued troubleshooting today. And by checking logs on server site, we learned that server is sending back a 400. This is why the string of 200 will never be hit in the configured receive string. When drafting the Send string, we following the recommendation in  K2167: Example send string GET /index.html HTTP/1.1\r\nHost: host **.** example **.** com Customized it: GET //api/v1/system/services/status?service\_names=nae-kmip HTTP/1.1 \r\nConnection: Close But server still sends 400. Interestingly, when using openssl by using the same link we receive HTTPP code 200: (echo -e "GET /api/v1/system/services/status?service\_names=nae-kmip HTTP/1.1\r\nHost: **.** _._**_.\r\nConnection: Close\r\n\r\n";sleep 1) | openssl s\_client -connect ._.**_._\*\*.:443 --- **HTTP/1.1 200 OK** Date: Wed, 06 Nov 2024 17:34:10 GMT Content-Type: application/json; charset=UTF-8 Content-Length: 73 Connection: close X-Krakend: Version 2.2.0 X-Krakend-Completed: false X-Processing-Time: 0.000031 X-Request-Id: 7f2830f5-9e4a-4d80-9bc4-1fe2cce2f02f Expires: Wed, 06 Nov 2024 16:34:10 GMT Cache-Control: no-cache X-Frame-Options: DENY Strict-Transport-Security: max-age=31536000; includeSubdomains; preload X-XSS-Protection: 1; mode=block Client-Verify: NONE X-Content-Type-Options: nosniff X-Permitted-Cross-Domain-Policies: none Feature-Policy: geolocation ‘none’; camera ‘none’; speaker ‘none’; microphone ‘none’; Referrer-Policy: strict-origin-when-cross-origin Expect-CT: enforce, max-age=72000 Content-Security-Policy: default-src ‘self’ blob:;base-uri ‘self’; form-action ‘self’; frame-ancestors ‘self’; script-src ‘self’; style-src ‘self’ ‘unsafe-inline’; font-src ‘self’ data:; object-src ‘none’; img-src ‘self’ data:; Cache-Control: no-store {“status”:“started”,“services”:[{“name”:“nae-kmip”,“status”:“started”}]} closed #   ---
**Author:** ![Paulius](https://d1p9zq3aats0t8.cloudfront.net/user_avatar/community.f5.com/paulius/32/21698_2.png) [@Paulius](https://community.f5.com/u/Paulius)\ **Post date:** [November 16, 2024, 6:04am UTC](https://community.f5.com/t/https-monitor-health-receive-string-200-ok-not-working/75373/7 "2024-11-16T06:04:01Z")
@Netmart You might want to perform a capture on the server side as well as a tcpdump on the F5 side to see exactly what is being sent to the server and why the server is seeing it as a bad request. I did notice that in your customized GET you have double // at the beginning of the path and a space after 1.1. So the following is what you have. GET //api/v1/system/services/status?service\_names=nae-kmip HTTP/1.1 \r\nConnection: Close **You should have the following instead to match the openssl query.** GET /api/v1/system/services/status?service\_names=nae-kmip HTTP/1.1\r\nConnection: Close **Notice that the extra / before api is gone.** If this is incorrect in your monitor I can see why this isn’t working properly. Have you attempted the same query using curl instead from the F5? I also noticed that you aren’t specifying a host field even though HTTP 1.1 does specify a necessity to have a host field entry. Typically if you do not define the host header it will be blank or the F5 will automatically convert it to the IP of the pool member before sending the query. If you do a tcpdump you should be able to see this information being sent if you open it up in wireshark and use the SSL key to decrypt the tcpdump. I believe the following will assist you with decrypting the tcpdump in wireshark. > **[Decrypt SSL with Wireshark - HTTPS Decryption: Step-by-Step Guide](https://www.comparitech.com/net-admin/decrypt-ssl-with-wireshark/)** > > Ever tried using Wireshark to monitor web traffic? You've probably run into a problem? A lot of it is encrypted. Here's how I decrypt SSL with Wireshark. ---
**Author:** ![Netmart](https://avatars.discourse-cdn.com/v4/letter/n/9e8a1a/32.png) [@Netmart](https://community.f5.com/u/Netmart)\ **Post date:** [November 19, 2024, 4:05am UTC](https://community.f5.com/t/https-monitor-health-receive-string-200-ok-not-working/75373/8 "2024-11-19T04:05:35Z")
Thank you Paulius. When we took  a capture the Self IP of F5 is used as source. Testing with OpenSSL we get a 200 in response header: (echo -e “GET / HTTP/1.1\r\nHost: \\r\nConnection: Close\r\n\r\n”;sleep 1) | openssl s\_client -connect \:443 We made sure to use the proper format - one slash “/” Regards. Netmart