Technical Forum
Ask questions. Discover Answers.
Showing results for 
Search instead for 
Did you mean: 
Custom Alert Banner

How to detect RST timeouts and http timeouts through irules


How to detect http request timeout and tcp rst through irules and log to ltm log


For the TCP RST do you really need an iRule to detect this as there are global variables ? Also if the irule is causing the RST because of a config error look in the /var/log/ltm for "TCL error:" messages or for "reject" in the irule.


 If you TCL Errors google the error and solve it (also check the F5 ihealth if it detected issue with the irule and check the error in F5 bug tracker and if needed use the "Catch" command to escape the error.





For HTTP request timeout because the F5 HTTP profiles or TCP connection timeout because the TCP profiles the TCP RST variables should log this.





Another hint is when writting an iRule to set variables that log at the Client_Accepted , HTTP_REQUEST etc. events and then to log the variables in /var/log/ltm or for example in splunk and then to compare when TCP handshake was done and after what time the HTTP_REQUEST event was triggered maybe at its end or start etc.



See the Splunk iRule and for example the variables:


set tcp_start_time [clock clicks -milliseconds]

set req_start_time [clock format [clock seconds] -format "%Y/%m/%d %H:%M:%S"]




You can modify the Irule to log to /var/log/ltm if needed but I don't recommend logging much data locally. Read: