Monitoring WebSphere with the LTM HTTP Monitor

In researching my tech tip last week (Replacing the WebSphere Apache Plugin with iRules), I ran across another interesting tidbit about monitoring WebSphere with LTM that apparently is not documented in the Deployment Guide (Deploying the BIG-IP LTM system and IBM WebSphere Servers.

The Deployment Guide was written for WebSphere ver. 6.0, and demonstrates creating an HTTP monitor with a simple GET request over HTTP 1.0.  We've had recent reports from the field that at least for version 6.1, you actually have to use an HTTP monitor that sends the GET request over HTTP 1.1 with the required hostname specified as * (asterisk), which seems to allow the servers to respond to the request.  (Using the VS hostname or any other string doesn't seem to work.)

Here's a solution that details how to construct a proper Send string for an HTTP 1.1 monitor: 

SOL2167: Writing full HTTP commands for Extended Content Verification (ECV) or Extended Application Verification (EAV) health monitors

CMP-compatible Class Lists

Current versions of LTM have implemented Clustered Multi Processing, or CMP, to allow systems with multiple cores to share the processing of connections from a single virtual server.  Not all connection information is shared across cores, so enabling some features on a virtual server which require state or data synchronization between the cores will cause connections to be ineligible for CMP. 

In iRules, global variables are intended to be dynamically updated, for which reason they are appropriately demoted from CMP processing.  Data Group Lists, or Classes, are a specific form of global variable. Since class data is read-only, and is available to all cores upon configuration load, there is no dynamic data sharing required between TMM instances, and there is no real need to demote a virtual server from CMP processing simply because it is represented as a global variable.

The LTM configuration parser identifies global variables (including classes) by the "$::" preamble:

  [ matchclass $HTTP_CONTENT contains $::my_data_class ]

In LTM 9.4.2, we introduced the ability to reference class lists from within an iRule without demoting them from CMP by referencing them without the "$" prefix.  To call a class list in a 9.4.2 or better iRule, use the findclass or the matchclass command with the new syntax:

  [ matchclass $HTTP_CONTENT contains ::my_data_class ]

iRules Feature Highlight: SSL Commands

Yet another section of the iRules wiki  has been fully updated with events and examples for all commands. The SSL commands for iRules provide the means to manage many aspects of SSL connections traversing LTM.  The available SSL iRules commands include:

• SSL::authenticate - Overrides the current setting for authentication frequency or for the maximum depth of certificate chain traversal.
• SSL::cert - Returns X509 SSL certificate data.
• SSL::cipher - Returns SSL cipher information.
• SSL::disable - Disables SSL processing.
• SSL::enable - Re-enables SSL processing.
• SSL::handshake - Halts or resumes SSL activity.
• SSL::mode - Gets the enabled/disabled state of SSL
• SSL::modssl_sessionid_headers - Returns a list of fields for HTTP headers
• SSL::profile - Switch between different SSL profiles
• SSL::renegotiate - Renegotiates an SSL connection.
• SSL::session - Drops a session from the SSL session cache.
• SSL::sessionid - Gets the SSL session ID.
• SSL::unclean_shutdown - Sets the value of the Unclean Shutdown setting.
• SSL::verify_result - Gets or sets the result code for peer certificate verification.

"High Performance in a Virtualized World" - Casero Plugs iRules for Web 2.0

From "Giving Telecoms a Competitive Edge with Web 2.0 Services":

"Casero uses BIG-IP LTM in all of our Web 2.0 solutions largely because of F5’s iRules scripting language, which gives us a great deal of flexibility to customize our customers’ application traffic management.

Once we made the decision to use iRules, it took less than an hour to do the actual design and scripting.

...

What we find is that it is essential for us to have the rich scripting at layer 7 we get from iRules. Although other solutions offer some of that capability, when we’ve tried to take advantage of it, we’ve taken a huge hit in terms of performance. And sacrificing performance by adding rules is the last thing in the world we want to do.

...

There’s a fundamental shift in the computing world with virtualization. Gone are the days when we’d have one big system with many applications running on it, and so we need a way to redirect traffic to a specific target area in this virtualized environment. That’s where the flexibility of writing iRules comes into play."

Couldn't have said it better myself.  All that, and more in the online article. 

iRules Feature Highlight: X.509 Commands

We have recently updated the iRules wiki to flesh out all of the events and examples for the iRules commands that have been implemented to manipulate X.509 certificates.

The available X509 iRules commands may be found here: iRules Reference: X509 and include:

• X509::cert_fields - Returns a list of fields to be added to HTTP headers for ModSSL behavior. 
• X509::extensions - Returns the X509 extensions set on an X509 certificate.
• X509::hash - Returns the MD5 hash (fingerprint) of an X509 certificate.
• X509::issuer - Returns the issuer of an X509 certificate.
• X509::not_valid_after - Returns the not-valid-after date of an X509 certificate.
• X509::not_valid_before - Returns the not-valid-before date of an X509 certificate.
• X509::serial_number - Returns the serial number of an X509 certificate.
• X509::signature_algorithm - Returns the signature algorithm of an X509 certificate.
• X509::subject - Returns the subject of an X509 certificate.
• X509::subject_public_key - Returns the subject’s public key of an X509 certificate.
• X509::subject_public_key_RSA_bits - Returns the size of the subject’s public RSA key of an X509 certificate.
• X509::subject_public_key_type - Returns the subject’s public key type of an X509 certificate.
• X509::verify_cert_error_string - Returns an X509 certificate error string.
• X509::version - Returns the version number of an X509 certificate.
• X509::whole - Returns an X509 certificate in PEM format.

iRules Feature Highlight: GTM Commands

I've recently updated the iRules wiki to reflect the iRules commands that have been implemented on GTM, here for your reference:

iRules Reference: GTM

It lists the commands and events specific to GTM, and also those that are shared with LTM. A few notable additions include:

• cname - Causes the specified name to be sent as a CNAME response.
• member_priority - Returns the priority of the specified pool member.
• whereis - Returns geographical information on an IP address.
• wideip - Returns information about the wideIP upon which the request arrived.

Stay tuned for future releases with more additions and enhancements on the GTM iRules front.

Toggling iRule Events

I posted an article yesterday about Disabling iRule Event Processing, and didn't really realize until after it was published how brill it was (JK ;^)

But seriously, it struck me after discussing it further with a co-worker that this solution has broader possibilities for other applications & protocols that may require selective iRule processing, specifically those for which we have protocol triggers and typically carry multiple requests per connection.  (The example used HTTP, and SIP springs immediately to mind.)  While you can use conditional statements to control iRule processing against any connection or request, disabling processing in specific events until it's needed again might be a good optimization to consider.

Unlocking the Hidden Value of Your Network

Looks like we just published an interesting new Webinar, Unlocking the Hidden Value of Your Network, which features Gartner Research Vice President Joe Skorupa.

Skorupa explains: 

“We’ve entered the era where the network is in fact the corporation. For most companies today, if the network goes down, they cease to exist as a functional entity. And in today’s tight economic times, network technologies must do more than just support the business; they actually have to enhance the business by lowering costs and improving agility. For organizations taking this approach, we (Gartner) typically see an ROI for Application Delivery Networks in significantly less than 12 months.”

For more information and access to the webinar, browse on over to: Unlocking the Hidden Value of Your Network

I Love Jack Daniels!

Truth be told, I'm actually a huge tequila fan, but this was too good not to pass along.

One of my co-workers shared with me a beautifully formatted and quite comprehensive Regular Expressions Cheat Sheet.  (I was too busy drooling over the tech-y goodness to notice the URL until he pointed it out.)  Upon browsing to the site, it turns out there are equally impressive offerings for:

SQL Server

MySQL

HTML

HTML Character Entities

Microformats

Ruby on Rails

ASP / VBScript

JavaScript

mod_rewrite

CSS

and of course

World of Warcraft (!?)

Enjoy!

/deb

Wow, how many of these do YOU remember?

A critical mass of 3 or more engineers in a room for more than 4 hours at a time will (with ~90% certainty) evolve (devolve?) into a conversation starting with that old gem:

"Well, I remember when..."

Last week it was all about membership in The 300 Baud Club.  If "Hayes AT command set" means anything to you, follow his links for this and some other serious geek history.

This week it's mobile phones. Check out this video: The Evolution of Mobile Phones.  I was shocked to see how many of these tiny expensive things I've personally owned, being a non-technophile for all these years & all.

I was sort of surprised that one old fave of mine didn't make the cut:  The original "smartphone", the Nokia 9000 Communicator, (which you may remember was prominently featured in the 1997 movie "The Saint".)  Back in '96/'97 I subcontracted at PacBell Mobile Services, working with Nokia on the initial deployment of this phone back when the US GSM network was still in diapers.  The Communicator ran a DOS-based OS on an Intel processor (pretty forward-thinking, eh?!?) and was one of the first devices to leverage SMS for higher level data services.  I think it would have gained much wider acceptance if the price point had been lower (about $2K just for the device. Cool, but not that cool, I guess) and if it had weighed just a bit less - almost a pound, IIRC.

BIG-IP wasn't quite there yet in 1996, but F5 caught the wave later & we've since been instrumental in 2G/3G implementations around the globe, regularly adding features that are key to supporting a robust worldwide wireless infrastructure.  4G, look out - we're so on it!

it's not about politics...

Hope everyone had a nice long weekend.
Let's keep remembering:

The Gratitude Campaign

Dancing with the Stars: LTM pairs up with VMware via iControl

I blogged earlier about a demo of pyControl, which is a command line wrapper for iControl.

We just saw yet another impressive demonstration this morning of the power and flexibility of iControl as an enterprise data center integration and virtualization tool: Leveraging the VMware API with a user-friendly graphical iControl application.

Nicolas Menant, iControl Architect for F5 EMEA, just showed us an application he is developing that creates a bi-directional interface between the LTM and VMware APIs.  The application provides a platform for custom dynamic provisioning and basic administration per VMware instance, and lots of other bells & whistles that takes some of the complexity out of this set of management tasks.

The solution is currently being tested, and will be posted to the iControl codeshare as soon as it is validated.

pyControl: iControl Made Easy - Really!

Programmer or not (and especially if you're not), if you are responsible for any aspect of monitoring or managing F5 gear, you need pyControl!

As I mentioned yesterday, we are spending this morning talking about iControl.  (You may have heard of it -- it's the next iRules! If not, you can get acquainted with iControl here.)  pyControl is a wrapper for the iControl API that dramatically lowers any barriers to entry that a lack of programming background might seem to impose.

pyControl is soooooo easy to use.  A quick download and few simple steps to get the underlying infrastructure installed, then with embedded help and tab completion at every level, you can start poking around in the inner workings of your LTM systems within 15 minutes or so. 

"One of the goals for the project is to make it as easy as possible for our customers to get started using iControl (we’ve got it down to 3 lines of code). Not enough of our customers take advantage of iControl, and we felt Python’s gentle learning curve (it’s just plain fun to write Python code) and portability across platforms really filled a niche."

You can interactively manage an LTM system, modify the load balancing configuration and view statistics for system and load balancing using simple python logic in the iPython shell.  But even better, you can build and save scripts to use for common dynamic system management or data center virtualization tasks.

For example, one of the SE's responsible for the initiation of this F5 Labs project, Matt Cauthorn, has just given a demo of an automatic provisioning and reservation system for a Xen based virtual data center.  It creates and manages virtual server instances and provides a resource "checkout" to create and manage entire data centers on the fly.  (We'll be posting a demo shortly to make it even easier for you to see how easy it is!)

Making difficult things possible

Wow, another intensely productive day in a room at HQ headquarters with some of the best & brightest iRules/iControl F5 minds from Field Services, Consulting, Product Development, Business Development, IT and Product Management.  Colin posted after yesterday's session, which was a-mazing, and today was even better. 

We previewed some long-awaited iRules functionality that's slated for an upcoming release, and discussed at least a dozen more actionable product enhancement ideas passed along by your SE's, covering everything from usability enhancements to some crazy useful additional iRules functionality.  So many case studies I don't even know where to start, but just let me say these guys are really pushing the envelope to solve a huge variety of application woes for customers all over the globe.  We're recording some of these stories for DCTV, and you'll see a lot of the resulting code in the DevCentral codeshares in upcoming weeks, so keep an eye out for that.

Looking forward to Day 3 -- apparently we'll be talking mostly about iControl and taking the pyControl & Java Wrappers our for a spin...

The day drew to a late close with a tasty impromptu dinner gathering at T.S. McHughe's Irish Pub that also included one of the F5 Training content developers who are working hard to bring you the much-requested upcoming iRules class. It's shaping up nicely, and should help create some more "iRules experts" for our little community here.

iRules and iControl are truly, as one of the SE's put it, "making simple things easy and difficult things possible" in the realm of application management, and although I've been around a long time, I'm still impressed and pleasantly surprised at every turn by the depth and breadth of business issues we can address with our little "boxes".

more later...

/deb

iRule Feature Highlight: HTTP::is_redirect

I recently helped optimize an iRule intended to manipulate server-set redirects and was re-acquainted with a handy iRules command:  HTTP::is_redirect.

It's a Boolean command that tests for HTTP redirect response codes and returns 1 for a match, 0 for no match.

A fairly common practice seems to be to use the HTTP::status command to retrieve the HTTP response status code, then compare it to a list of possible HTTP redirect response status values.  However, since not all 3xx responses are redirects, it's not enough to check if the status begins with a "3".  Instead, the HTTP status code must be compared to a list of possible values (rather than a single value) in order to capture only the desired responses.  Therefore, in most cases it will be more optimal and more accurate to use the HTTP::is_redirect command instead of the HTTP::status command. 

The following response codes cause HTTP::is_redirect to return a match (and all include a Location header directing the browser to an alternate resource):

• 301 (Moved Permanently)
• 302 (Found)
• 303 (See Other)
• 305 (Use Proxy)
• 307 (Temporary Redirect)