TCL errors

adick · February 9, 2024, 12:17am

Hey Team,

We are experiencing some TCL errors with one of our iRules.

I didn’t build the iRule, but have inherited it from a past engineer, so I don’t have a ton of knowledge on the specifics, but I’m wondering if it is something we can discover a fix for:

Error:

partition1/F5_L4_TCP_IPFIX

Feb 8 13:52:18 DN-DC3-LTM-02.domainname.com err tmm5[13713]: 01220001:3: TCL error: /partition1/F5_L4_TCP_IPFIX <CLIENT_CLOSED> - can’t read “rule1_msg1”: no such variable while executing “IPFIX::msg set $rule1_msg1 postOctetTotalCount [IP::stats bytes in]”
Feb 8 13:52:19 DN-DC3-LTM-02.domainname.com err tmm4[13713]: 01220001:3: TCL error: /partition1/F5_L4_TCP_IPFIX <SERVER_CLOSED> - can’t read “rule1_msg1”: no such variable while executing “IPFIX::msg set $rule1_msg1 octetTotalCount [IP::stats bytes out]”
Feb 8 13:52:19 DN-DC3-LTM-02.domainname.com err tmm4[13713]: 01220001:3: TCL error: /partition1/F5_L4_TCP_IPFIX <CLIENT_CLOSED> - can’t read “rule1_msg1”: no such variable while executing “IPFIX::msg set $rule1_msg1 postOctetTotalCount [IP::stats bytes in]”
Feb 8 13:52:19 DN-DC3-LTM-02.domainname.com err tmm5[13713]: 01220001:3: TCL error: /partition1/F5_L4_TCP_IPFIX <SERVER_CLOSED> - can’t read “rule1_msg1”: no such variable while executing “IPFIX::msg set $rule1_msg1 octetTotalCount [IP::stats bytes out]”
Feb 8 13:52:19 DN-DC3-LTM-02.domainname.com err tmm5[13713]: 01220001:3: TCL error: /partition1/F5_L4_TCP_IPFIX <CLIENT_CLOSED> - can’t read “rule1_msg1”: no such variable while executing “IPFIX::msg set $rule1_msg1 postOctetTotalCount [IP::stats bytes in]”
Feb 8 13:52:20 DN-DC3-LTM-02.domainname.com err tmm3[13713]: 01220001:3: TCL error: /partition1/F5_L4_TCP_IPFIX <SERVER_CLOSED> - can’t read “rule1_msg1”: no such variable while executing “IPFIX::msg set $rule1_msg1 octetTotalCount [IP::stats bytes out]”
Feb 8 13:52:20 DN-DC3-LTM-02.domainname.com err tmm3[13713]: 01220001:3: TCL error: /partition1/F5_L4_TCP_IPFIX <CLIENT_CLOSED> - can’t read “rule1_msg1”: no such variable while executing “IPFIX::msg set $rule1_msg1 postOctetTotalCount [IP::stats bytes in]”
[user@DN-DC3-LTM-02:Active:In Sync] log #
[user@DN-DC3-LTM-02:Active:In Sync] log #

IRULE:

when RULE_INIT { set static::http_rule1_dest “” set static::http_rule1_tmplt “”} # CLIENT_ACCEPTED event to initiate IPFIX destination and templatewhen CLIENT_ACCEPTED { set start [clock clicks -milliseconds] if { $static::http_rule1_dest == “”} { # open the logging destination if it has not been opened yet set static::http_rule1_dest [IPFIX::destination open -publisher /western-hemisphere/IPFIX-PUB1] } if { $static::http_rule1_tmplt == “”} { # if the template has not been created yet, create the template set static::http_rule1_tmplt [IPFIX::template create “flowStartMilliseconds \ sourceIPv4Address \ sourceIPv6Address \ destinationIPv4Address \ destinationIPv6Address \ sourceTransportPort \ destinationTransportPort \ protocolIdentifier \ octetTotalCount \ packetTotalCount \ octetDeltaCount \ packetDeltaCount \ postNATSourceIPv4Address \ postNATSourceIPv6Address \ postNATDestinationIPv4Address \ postNATDestinationIPv6Address \ postNAPTSourceTransportPort \ postNAPTDestinationTransportPort \ postOctetTotalCount \ postPacketTotalCount \ postOctetDeltaCount \ postPacketDeltaCount \ flowEndMilliseconds”] }} # SERVER_CONNECTED event to initiate flow data to Tetration and populate 5 tupleswhen SERVER_CONNECTED { set rule1_msg1 [IPFIX::msg create $static::http_rule1_tmplt] set client_closed_flag 0 set server_closed_flag 0 IPFIX::msg set $rule1_msg1 flowStartMilliseconds $start IPFIX::msg set $rule1_msg1 protocolIdentifier [IP::protocol] # Clientside if { [clientside {IP::version}] equals “4” } { # Client IPv4 address IPFIX::msg set $rule1_msg1 sourceIPv4Address [IP::client_addr] # BIG-IP IPv4 VIP address IPFIX::msg set $rule1_msg1 destinationIPv4Address [clientside {IP::local_addr}] } else { # Client IPv6 address IPFIX::msg set $rule1_msg1 sourceIPv6Address [IP::client_addr] # BIG-IP IPv6 VIP address IPFIX::msg set $rule1_msg1 destinationIPv6Address [clientside {IP::local_addr}] } # Client port IPFIX::msg set $rule1_msg1 sourceTransportPort [TCP::client_port] # BIG-IP VIP port IPFIX::msg set $rule1_msg1 destinationTransportPort [clientside {TCP::local_port}] # Serverside if { [serverside {IP::version}] equals “4” } { # BIG-IP IPv4 self IP address IPFIX::msg set $rule1_msg1 postNATSourceIPv4Address [IP::local_addr] # Server IPv4 IP address IPFIX::msg set $rule1_msg1 postNATDestinationIPv4Address [IP::server_addr] } else { # BIG-IP IPv6 self IP address IPFIX::msg set $rule1_msg1 postNATSourceIPv6Address [IP::local_addr] # Server IPv6 IP address IPFIX::msg set $rule1_msg1 postNATDestinationIPv6Address [IP::server_addr] } # BIG-IP self IP port IPFIX::msg set $rule1_msg1 postNAPTSourceTransportPort [TCP::local_port] # Server port IPFIX::msg set $rule1_msg1 postNAPTDestinationTransportPort [TCP::server_port]} # SERVER_CLOSED event to collect IP pkts and bytes count on serversidewhen SERVER_CLOSED { set server_closed_flag 1 # when flow is completed, BIG-IP to server REQUEST pkts and bytes count IPFIX::msg set $rule1_msg1 octetTotalCount [IP::stats bytes out] IPFIX::msg set $rule1_msg1 packetTotalCount [IP::stats pkts out] # when flow is completed, server to BIG-IP RESPONSE pkts and bytes count IPFIX::msg set $rule1_msg1 octetDeltaCount [IP::stats bytes in] IPFIX::msg set $rule1_msg1 packetDeltaCount [IP::stats pkts in] if { $client_closed_flag == 1} { # send the IPFIX log IPFIX::destination send $static::http_rule1_dest $rule1_msg1 }} # CLIENT_CLOSED event to collect IP pkts and bytes count on clientsidewhen CLIENT_CLOSED { set client_closed_flag 1 # when flow is completed, client to BIG-IP REQUEST pkts and bytes octetDeltaCount IPFIX::msg set $rule1_msg1 postOctetTotalCount [IP::stats bytes in] IPFIX::msg set $rule1_msg1 postPacketTotalCount [IP::stats pkts in] # when flow is completed, BIG-IP to client RESPONSE pkts and bytes count IPFIX::msg set $rule1_msg1 postOctetDeltaCount [IP::stats bytes out] IPFIX::msg set $rule1_msg1 postPacketDeltaCount [IP::stats pkts out] # record the client closed time in ms IPFIX::msg set $rule1_msg1 flowEndMilliseconds [clock click -milliseconds] if { $server_closed_flag == 1} { # send the IPFIX log IPFIX::destination send $static::http_rule1_dest $rule1_msg1 }}

KeesvandenBos · February 9, 2024, 4:52pm

Hi,

The error occurs when the rule1_msg1 variable is empty.
This could happen if a client doesn’t complete the 3way handshake and send a reset. Then the CLIENT_CLOSE event is hit without the client sending any data, leaving rule1_msg1 being never created in the other events.

Maybe you can solve this by adding this line in the when RULE_INIT { section

when RULE_INIT <span class="token punctuation">{</span>
    <span class="token keyword">set</span> <span class="token variable">static::http_rule1_dest</span> <span class="token string">""</span>
    <span class="token keyword">set</span> <span class="token variable">static::http_rule1_tmplt</span> <span class="token string">""</span>
    <span class="token keyword">set</span> <span class="token variable">rule1_msg1</span> <span class="token string">""</span>
<span class="token punctuation">}</span>

Hope it helps.

Cheers,

Kees

adick · February 9, 2024, 10:25pm

Thanks Kees!

This seems to be a good solution.

Could there be other reasons the CLIENT_CLOSE event could get hit without the client sending data? I’m wondering if this iRule could be causing any problems with the VIPs that it is configured on? I heard from someone when you see TCL errors it usually means the VIP communication was cut off early.

Or if because it only triggers on CLIENT_CLOSE maybe it is something where the client already had problems communicating and this is just the error that triggers when there is another issue present.

Thanks

F5_Design_Engineer · February 10, 2024, 3:23am

Hi Adick,

There are many TCL online editors that you can check your code, you can make changes and execute till you find the desired results.

Hope this Helps.

KeesvandenBos · February 11, 2024, 10:04am

Your welcome.

CLIENT_CLOSED events gets triggers by the client ending the connection. And yes it is true, any TCL error will cause the Virtual Server to stop processing traffic.

rule1_msg1 not being filled with data (and causing the TCL error) will only happen if a client doesn’t send any data after the connection has been created, same for SERVER_CLOSED TCL error. If this irule is attached to a virtual server without a proxy profile (L7 connection) the BIG-IP will create the server connection the moment thhttps://my.f5.com/manage/s/article/K8082e client connection is completed. If the client doesn’t send any data, in the end the pool member will close its connection with the BIG-IP.
K8082 explains the differences between virtual server types.

It could be a client issue causing these erros’ Still it is better to first create an empty variable to make sure you do not run into issues.

Cheers,
Kees

Topic		Replies	Views
TCL Error possibly causing TCP Resets? Technical Forums application-delivery , event	6	489	July 21, 2025
irule execution error Technical Forums application-delivery	6	272	January 20, 2026
Dealing with iRule $variables for HTTP2 workload while HTTP MRF Router is enabled Technical Forums application-delivery	16	4155	October 10, 2025
TCL error: _cgc_pick_clientside Technical Forums application-delivery , ltm , security , asm-advanced-waf , ssl , clientssl , sni	5	1810	April 12, 2025
BIG-IP DNS iRule issue with static variable Technical Forums application-delivery , dns	2	274	April 30, 2024

TCL errors

Related topics