F5 GTM ltm log error"unknown cgc sni"
I have a pair of BIG-IP i2600 here, used as GTM, software version 13.1.1.2. Current backup machine ltm log alarm err tmm1 [12245]: 01220001:3: TCL error: _cgc_pick_clientside<CLIENT DATA>- unknown cgc sni: x.x.x.x (line 49) invoiced from within "CGC:: sni $tls_server" where x.x.x.x is F5's self ip. What is the reason, what information needs to be checked, and how to handle it?
BIG-IP : tcl boolean logic for string comparisons
F5 BIG-IP Virtual Edition v11.4.1 (Build 635.0) LTM on ESXi What is correct syntax for boolean operations around string comparisons ? set a "a" set b "b" set result 0 if { { $a eq "a" } && { $b eq "b" } } { set result 1 } This compiles but throws a runtime exception : expected boolean value but got " $a eq "a" " while executing "if { { $a eq "a" } && { $b eq "b" } ...
Reselect member with new port
Hi, I am not sure if my rule is broken or there is some bug in v11.2.0 I have VS IP:8888 with pool containing members set to All ports IP:0 but backed server is listening on port 443. I need to change port from 8888 to 443 when connecting to backed server. I tired this iRule but always getting error like that: TCL error: /Common/http_to_https_one_vs - failed to find pool member (line 1) invoked from within "pool LAMP_110_all_pl member 10.128.30.110 443" when LB_SELECTED { pool LAMP_110_all_pl member 10.128.30.110 443 } I tried putting above command in HTTP_REQUEST event but error is the same. Tried to use /Common/LAMP_110_all_pl as well, no difference. However everything works OK when I switch to below code when LB_SELECTED { LB::reselect node 10.128.30.110 443 } I would prefer to use first one as second one seems to be messing up with LB a bit. By that I mean that before LB::reselect is used, LB::server name is returning /Common/PoolName 10.128.30.110 0 after reselect just 10.128.30.110 443 and in node command (don't know if it is realted to LB::reselect node as well) there is note: Since statistics and health monitoring are tied to pool membership, node status and statistics for this connection will not be available. So why pool LAMP_110_all_pl member 10.128.30.110 443 is returning error? PiotrLB_SELECTED and HTTP commands - warning
Hi, It took me off guard when doing some test with TCP profile. Be advised that under some conditions HTTP type commands may generate TCL error like that: TCL error: /Common/host_change_member - Illegal argument. Can't execute in the current context. (line 1) invoked from within "HTTP::host" It was caused by such code: when LB_SELECTED { if { [LB::server addr] eq "10.128.30.110" } { set host "host1.test.com" } else { set host "host2.test.com" } HTTP::header replace Host $host } Pretty safe code I guess, but... If for some reason LB_SELECTED is triggered when no HTTP request is received, then mentioned error will be logged and of course connection will be reset. I don't know other conditions causing this except: In TCP profile enable Verified Accept Above option seems to be rather dangerous for standard type VS (especially HTTP) as it breaks standard LB logic. Instead of performing LB decision after successful client side 3WHS and first HTTP request received it performs LB after receiving SYN packet from client. To avoid this problem it's better to perform HTTP related operations (that have to be based on some data collected during LB_SELECTED which is triggered after HTTP_REQUEST) in HTTP_REQUEST_RELEASE. Piotr
Reselect member with new port
Hi, I am not sure if my rule is broken or there is some bug in v11.2.0 I have VS IP:8888 with pool containing members set to All ports IP:0 but backed server is listening on port 443. I need to change port from 8888 to 443 when connecting to backed server. I tired this iRule but always getting error like that: TCL error: /Common/http_to_https_one_vs - failed to find pool member (line 1) invoked from within "pool LAMP_110_all_pl member 10.128.30.110 443" when LB_SELECTED { pool LAMP_110_all_pl member 10.128.30.110 443 } I tried putting above command in HTTP_REQUEST event but error is the same. Tried to use /Common/LAMP_110_all_pl as well, no difference. However everything works OK when I switch to below code when LB_SELECTED { LB::reselect node 10.128.30.110 443 } I would prefer to use first one as second one seems to be messing up with LB a bit. By that I mean that before LB::reselect is used, LB::server name is returning /Common/PoolName 10.128.30.110 0 after reselect just 10.128.30.110 443 and in node command (don't know if it is realted to LB::reselect node as well) there is note: Since statistics and health monitoring are tied to pool membership, node status and statistics for this connection will not be available. So why pool LAMP_110_all_pl member 10.128.30.110 443 is returning error? Piotr(Some) iRule 'HTTP::header remove' causes TCL error following 11.6 HF4 upgrade
We upgraded our proxy from 11.6 HF3 to 11.6 HF4 last week, and immediately started seeing these errors related to one of our iRules: May 19 10:56:29 f5-proxy1 err tmm[16515]: 01230140:3: RST sent from 10.10.12.49:443 to 192.168.1.136:42865, [0x1eb6bf8:1288] iRule execution error May 19 10:56:29 f5-proxy1 err tmm[16515]: 01220001:3: TCL error: /Common/sanitize_http - Operation not supported (line 22) invoked from within "HTTP::header remove $header" ("foreach" body line 15) invoked from within "foreach header [HTTP::header names] { if { $log_level >= $static::LOG_LEVEL_NOTICE } { This code was working before the HF4 upgrade, and still works for a large set of clients. But a subset of clients fail reliably. I have not yet been able to gather inputs for comparison, and frankly am just hoping that someone will know of something with HF4 that causes this and be able to point me to a workaround or fix. I'll continue digging on this end, and will update if I find out more. Update: HF4 does not appear to be part of the problem - The iRule errors in question are caused because the application backend is not available, but iRules are processing anyway. The attempt to modify the header is apparently at odds with the way the F5 is going to bounce the request. I have not been able to make anyone 'fess up to a correlation between the HF4 upgrade timing and the backend for this particular application being taken offline, but that's the most likely candidate for why it seemed to appear with HF4. (The problem would presumably be alleviated were the Virtual correctly configured for Availability Monitoring, so I'm pushing to get that straightened out.)iRule TCL Error and Fallback Host
Hi, Just another finding that surprised me a bit :-) Scenario: HTTP profile with Fallback Host set (Fallback on Error Codes can be empty or contain codes) Single member pool iRule causing TCL error I was under impression that Fallback Host is used under two conditions: Member returned one of codes defined in Fallback on Error Codes There is no active member left in the pool It turns out that Fallback Host is as well used when iRule TCL Error is generated - instead of sending RST to client. Then BIG-IP sends FIN-ACK to client to close connection. Piotr
warning: [use curly braces to avoid double substitution]
I'm getting this a lot while converting irules from v10.2.4 to v11.5.3, and I don't understand either the warning or the fix. Here are a few random (unrelated) lines with the warning: if [catch {virtual name} virtualName] set aclmr_virtualSite [lindex $aclmr_parts [expr [llength $aclmr_parts] - 2]] if [catch "matchclass $aclmr_clientIP equals $aclmr_ipLookupClass" val] { set lWay [expr $lWay - 1] set virtualSite [lindex $parts [expr [llength $parts] - 2]] What is the general situation that the warning is about, and how should it be corrected? I've seen comments that you should just add another layer of {} around expressions, but that has sometimes generated bad values at runtime (where the original lines, with warnings, work fine). Other answers I've seen posted just said "change xxx to yyy and it will work" without explanation.
TCL error :Prerequisite operation not in progress (line ...
I have an iRule that looks like this : when HTTP_REQUEST { if {[HTTP::path] eq "/"} { HTTP::uri "/newpath" pool website-pool} } It seems to do his job, but sometimes the next error appears in the Local Traffic Logs: TCL error: /Partition/iRule-name - Prerequisite operation not in progress (line 1) invoked from within "HTTP::path" TCL error: _plugin_rule_/Common/pluginasm - Prerequisite operation not in progress (line 1) invoked from within "HTTP::class asm" Tried searching for TCL errors but found nothing that could help me. Can someone tell me what I am doing wrong ? I know, it is only to keep the logs clean, but I want to understand what I am doing wrong.TCL error
Hi , What I try to do is show the putput of the command show pem stats subscriber .....This command is executed when typing tmsh..... How do I have to execute this command in TCL in the right dir ???? the polling itself works via snmpwalk but I get tcl callback pemconnection return string: couldn't execute "show": no such file or directory thanks for the help register_mib ".8" pem string proc pem {} { set result [exec tmsh] set status [catch {exec show pem stats subscriber | grep Unknown | grep -v Maximum} result] return $result }