Enabling AVR and creating Profiles
Hi All, I've recently provisioned the AVR module (nominal) with out too much trouble. However when I attempt to create a HTTP Analytics profile, I don't see all the my Virtual Servers. I don't see any Virtual Servers when I look at the Statistics->Analytics->HTTP. However I am able to access: Statistics->Analytics->Virtual Servers- Statistics->Analytics->Pools Not sure what I'm missing, that I'm unable to see all the relevant info. Appreciate all advice and suggestions. Thanks Deena
Most efficient methods for Connection logging?
Does anyone have real world experience with logging connections at a high rate? If so, which methods are you using to collect and transmit the data? We have a requirement to log all connections going through our F5 devices. Things like the client/server-side IPs/ports as well as HTTP details for HTTP VIPs and DNS details from our GTMs. It's the Whitehouse M-21-31 mandate if anyone if familiar with it. I've used Request Logging Profiles and various iRules with HSL to collect this type of data before, but I've never been too concerned about overhead because I would only apply them as needed, like when t-shooting an issue with a VIP. Our busiest appliance pushes around 150k conn/sec and 5k HTTP req/sec, so I now have consider the most efficient methods to avoid any kind of impact to traffic flows. I've done some lab testing with several different methods but I can't do any meaningful load tests in that environment.Below are some of my opinions based on my lab testing so far. Data Collection AVR - I like that this single feature can meet all the requirements for collecting TCP, HTTP, and DNS data. It would also be relatively easy to perform audits to ensure the VIPs have the necessary Analytics profiles as we can manage it from the AVR profiles themselves. My main concern is the overhead that results from the traffic analysis. I assume it has to maintain a large database where it stores all the analyzed data even if we just ship it off to Splunk. Even the data shipped off to Splunk includes several different logs for each connection (each with a different 'Entity'). Request Logging Profile- This is fairly flexible and should have low overhead since the F5 doesn't need to analyze any of the data like AVR does. This only collects HTTP data so we still need another solution to collect details for non HTTP VIPs. It would be a pain to audit since we don't have use any kind of deployment templates or automation. iRule - This provides a lot of flexibility and it is capable of collecting all the necessary data, but I don't know how well performance overhead compares to AVR. This would also be a pain to audit due to lack of deployment templates and automation. Data Transmission HSL UDP Syslog- I imagine this is the most efficient method to send events, but it's likely only a matter of time before we are required to use TCP/TLS. Telemetry Streaming - This is the more modern method and it offers some interesting features like System Poller, which could eventually allow us to move away from SNMP polling. We would need a workaround for our GTM-only devices because they cannot run a TS listener.
AVR: User-Agent Strings
I'm looking at the AVR metrics collected, and trying to figure out which user-agents are most common in our environment. When I look at the analytics page, I can see the top 10 user-agents, but I can't seem to get anywhere to copy the full user-agent string (so i can parse out the specifics). It always truncates it somehow, even when I export the PDF or CSV. I did find here that I can view the data I'm looking for through tmsh with something like show / analytics http report view-by user-agent range now-31d , but I'd like to find a way to grab it from the GUI instead if I could. Any thoughts or experience with this?
Why does "Page Load Time" in AVR show no sampled transactions?
Hi All, I've got AVR working fine other than this so far. It's not clear to me if Page Load Times, currently showing N/A to transactions, needs more in the analytics profile than just Statistics Logging Type enabling (set to internal at the moment). I've tried several options, I got it to work... Once... But pretty much all options were on. I don't actually want all options. Current settings I have: ltm profile analytics analytics { app-service none captured-traffic-external-logging disabled captured-traffic-internal-logging disabled collect-geo disabled collect-ip disabled collect-max-tps-and-throughput enabled collect-methods enabled collect-page-load-time enabled collect-response-codes enabled collect-subnets disabled collect-url disabled collect-user-agent disabled collect-user-sessions enabled collected-stats-external-logging disabled collected-stats-internal-logging enabled description none notification-by-email disabled notification-by-snmp disabled notification-by-syslog disabled partition Common publish-irule-statistics disabled sampling disabled session-cookie-security ssl-only session-timeout-minutes 5 smtp-config none traffic-capture { capturing-for-analytics { request-captured-parts headers response-captured-parts headers } } } The profile is attached to the appropriate virtual-server. Any and all input is much appreciated. JDAVR average server latency istats with Irule
I am looking for a particular use case to be able to read the AVR analytics average server response time and be able to mark the specific server down and use this information to make a proper load balancing decision. So basically lets say when the average server response latency is higher then 1000ms then we should not send traffic there but do a load balancing reselection. The following command is used in TMSH to view this data. Now I would like to collect this within the Irule. show analytics http report view-by pool-member range now-3d measures {average-server-latency } In the analytics profile I have seen the option "publish Irule statistics" and that is what I need, but how do I read the specific metric data from within the Irule? I read about istats is that what I need?
AVR Profile and Remote syslog
Hi all, Just wondering if anyone has managed to use an analytics profile to export the logs/data to an external source, ideally rsyslog? There was a lot of reading about SPLUNK and iApp's and also setting up log publishers/destinations, but I could not find anyone having success logging to a remote syslog server direct from an analytics profile. I think this is possible from the manual of AVR. Any help would be great, Thanks.
