Hello Guys, I'm trying to write an IIS monitor. On IIS servers I have aspx script, which returns 0, when server works fine and other value if not. I've created HTTP monitor: GET /IsAlive.aspx HTTP/1.1\r\nHost: www.test.com \r\nConnection: close\r\n\r\n The problem is that F5 cannot see all returned content from server, but only header and the main html tags, but I must to check the output specified in the attached file I've wrote an regexp, also present in the attached file F5 cannot see above content even if I type "Status" (without question marks) in the Receive String field under the monitor configuration tab. The return page is quite small, Content Length has only 1966 bytes. The strange fact is that F5 can see the [Receive String field] <\/body>\r\n<\/html> tag, which is the last expression in the response. Do you have any ideas how to fix it? ps.I've heard that F5 has some limitation with checking payload (it checks only 4KB including scripts that are referenced in html). Regards Paul

Paul, Just a couple of thoughts. You're right about a limit to the payload, see SOL3451 http://support.f5.com/kb/en-us/solutions/public/3000/400/sol3451.html?sr=25747390 What happens if you curl to this aspx page from the f5, do you see the expected response? See this article for help: https://devcentral.f5.com/wiki/AdvDesignConfig.TroubleshootingLtmMonitors.ashx Finally, you could try an external monitor (as sol3451 suggests). See also: https://devcentral.f5.com/wiki/advdesignconfig.HTTPMonitor_cURL_BasicGET.ashx Hope this helps, N

Hi Paul, Can you try removing a space in the send string: GET /IsAlive.aspx HTTP/1.1\r\nHost: www.test.com\r\nConnection: close\r\n\r\n I can't view the attachment. Can you reply with the content in a post between [ code ] [/ code ] blocks (without the spaces in the tags)? To test, can you try setting the receive string to 'HTTP/1\.(0|1) (2|3)' to mark the pool member up for any HTTP 1.0 or 1.1 2xx or 3xx response? Thanks, Aaron

Hi Nathan, curl (executed from BIG-IP) shows right content, but I've just noticed that when monitor check occur, server returns error page: 0x0000: 4500 05dc 0fde 4000 8006 ce10 0a00 0165 E.....@........e 0x0010: 0a00 01c9 0050 ed5c 5224 f069 5b2f d1e3 .....P.\R$.i[/.. 0x0020: 8010 fadd 4022 0000 0101 080a 06a1 78fe ....@"........x. 0x0030: 6603 594a 4854 5450 2f31 2e31 2035 3030 f.YJHTTP/1.1.500 0x0040: 2049 6e74 6572 6e61 6c20 5365 7276 6572 .Internal.Server 0x0050: 2045 7272 6f72 0d0a 4461 7465 3a20 5475 .Error..Date:.Tu 0x0060: 652c 2030 3420 4465 6320 3230 3132 2031 e,.04.Dec.2012.1 0x0070: 333a 3136 3a30 3620 474d 540d 0a53 6572 3:16:06.GMT..Ser 0x0080: 7665 723a 204d 6963 726f 736f 6674 2d49 ver:.Microsoft-I 0x0090: 4953 2f36 2e30 0d0a 582d 506f 7765 7265 IS/6.0..X-Powere that's the reason, why BIG-IP cannot see right content. The question is why server returns Code 500? The problem is in the HTTP GET Request. I'm trying to modify the request now. Regards Paul

can you try something similar to this? [root@ve10:Active] config b pool foo list pool foo { monitor all myhttp members 172.28.19.251:80 {} } [root@ve10:Active] config b monitor myhttp list monitor myhttp { defaults from http recv "Status\n\n0\n" send "GET /test.html HTTP/1.1\r\nHost: \r\nConnection: Close\r\n\r\n" } [root@ve10:Active] config curl -i http://172.28.19.251/test.html HTTP/1.1 200 OK Date: Tue, 04 Dec 2012 13:34:18 GMT Server: Apache/2.2.3 (CentOS) Last-Modified: Tue, 04 Dec 2012 12:58:16 GMT ETag: "4183f8-4e-6b55aa00" Accept-Ranges: bytes Content-Length: 78 Connection: close Content-Type: text/html; charset=UTF-8 Status 0 [root@ve10:Active] config b pool foo |grep -i pool\ member +-> POOL MEMBER foo/172.28.19.251:80 active,up

The question is why server returns Code 500? The problem is in the HTTP GET Request. I'm trying to modify the request now.you know we can run tcpdump to see curl request and use it in health monitor send string. e.g. [root@ve10:Active] config ssldump -Aed -nni 0.0 host 172.28.19.251 and port 80 New TCP connection 1: 172.28.19.80(38567) <-> 172.28.19.251(80) 1354627904.1183 (0.0016) C>S --------------------------------------------------------------- GET /test.html HTTP/1.1 User-Agent: curl/7.15.5 (i686-redhat-linux-gnu) libcurl/7.15.5 OpenSSL/0.9.8b zlib/1.2.3 libidn/0.6.5 Host: 172.28.19.251 Accept: */* ---------------------------------------------------------------

Problem with IIS monitoring

18 Replies

nitass
Employee
Dec 04, 2012
can you try health monitor send string which is similar to the one in tcpdump (you know you can open tcpdump file with wireshark and copy request string)?

pawel_jakacki_7

Nimbostratus

Dec 04, 2012

Yes, I had, the output is the following

15:44:42.673658 IP 10.x.X.201.43692 > 10.x.x.101.80: P 1:165(164) ack 1 win 115  out slot1/tmm0 lis=
        0x0000:  4500 00d8 e5ce 4000 4006 3d24 0a00 01c9  E.....@.@.=$....
        0x0010:  0a00 0165 aaac 0050 f1ea 8b1f 98ef 5a43  ...e...P......ZC
        0x0020:  8018 0073 2c46 0000 0101 080a 6654 7bc4  ...s,F......fT{.
        0x0030:  0000 0000 4745 5420 2f49 7341 6c69 7665  ....GET./IsAlive
        0x0040:  2e61 7370 7820 4854 5450 2f31 2e31 0d0a  .aspx.HTTP/1.1..
        0x0050:  5573 6572 2d41 6765 6e74 3a20 6375 726c  User-Agent:.curl
        0x0060:  2f37 2e31 392e 3720 2869 3638 362d 7265  /7.19.7.(i686-re
        0x0070:  6468 6174 2d6c 696e 7578 2d67 6e75 2920  dhat-linux-gnu).
        0x0080:  6c69 6263 7572 6c2f 372e 3139 2e37 204f  libcurl/7.19.7.O
        0x0090:  7065 6e53 534c 2f30 2e39 2e38 7520 7a6c  penSSL/0.9.8u.zl
        0x00a0:  6962 2f31 2e32 2e33 206c 6962 6964 6e2f  ib/1.2.3.libidn/
        0x00b0:  302e 362e 350d 0a48 6f73 743a 2031 302e  0.6.5..Host:.10.
        0x00c0:  302e 312e 3130 310d 0a41 6363 6570 743a  x.x.101..Accept:
        0x00d0:  202a 2f2a 0d0a 0d0a 0105 0100 0000 00    .*/*...........
15:44:42.675260 IP 10.x.x.101.80 > 10.x.x.201.43692: . 1:1449(1448) ack 165 win 64076  in slot1/tmm0 lis=
        0x0000:  4500 05dc 62b5 4000 8006 7b39 0a00 0165  E...b.@...{9...e
        0x0010:  0a00 01c9 0050 aaac 98ef 5a43 f1ea 8bc3  .....P....ZC....
        0x0020:  8010 fa4c fe9f 0000 0101 080a 06a2 48b0  ...L..........H.
        0x0030:  6654 7bc4 4854 5450 2f31 2e31 2032 3030  fT{.HTTP/1.1.200
        0x0040:  204f 4b0d 0a44 6174 653a 2054 7565 2c20  .OK..Date:.Tue,.
        0x0050:  3034 2044 6563 2032 3031 3220 3134 3a34  04.Dec.2012.14:4
        0x0060:  343a 3434 2047 4d54 0d0a 5365 7276 6572  4:44.GMT..Server
        0x0070:  3a20 4d69 6372 6f73 6f66 742d 4949 532f  :.Microsoft-IIS/
        0x0080:  362e 300d 0a58 2d50 6f77 6572 6564 2d42  6.0..X-Powered-B
        0x0090:  793a 2041 5350 2e4e 4554 0d0a 582d 4173  y:.ASP.NET..X-As
        0x00a0:  704e 6574 2d56 6572 7369 6f6e 3a20 322e  pNet-Version:.2.
        0x00b0:  302e 3530 3732 370d 0a53 6574 2d43 6f6f  0.50727..Set-Coo
        0x00c0:  6b69 653a 2041 5350 2e4e 4554 5f53 6573  kie:.ASP.NET_Ses
        0x00d0:  7369 6f6e 4964 3d67 3562 7132 6435 3578  sionId=g5bq2d55x
        0x00e0:  6667 7733 3334 3535 6177 3369 756a 6e3b  fgw33455aw3iujn;
        0x00f0:  2070 6174 683d 2f3b 2048 7474 704f 6e6c  .path=/;.HttpOnl
        0x0100:  790d 0a43 6163 6865 2d43 6f6e 7472 6f6c  y..Cache-Control
        0x0110:  3a20 7072 6976 6174 650d 0a43 6f6e 7465  :.private..Conte
        0x0120:  6e74 2d54 7970 653a 2074 6578 742f 6874  nt-Type:.text/ht
        0x0130:  6d6c 3b20 6368 6172 7365 743d 7574 662d  ml;.charset=utf-
        0x0140:  380d 0a43 6f6e 7465 6e74 2d4c 656e 6774  8..Content-Lengt
        0x0150:  683a 2031 3935 310d 0a0d 0a0d 0a0d 0a3c  h:.1951........<
        0x0160:  2144 4f43 5459 5045 2068 746d 6c20 5055  !DOCTYPE.html.P

pawel_jakacki_7
Nimbostratus
Dec 04, 2012
please, find the wireshark output in the attachment. Can you see it?
nitass
Employee
Dec 04, 2012
please, find the wireshark output in the attachment. Can you see it?no, i do not see any attachment.

can you open 2 SSH sessions? one is curl and the other one is ssldump (ssldump -Aed -nni 0.0 host 10.x.x.101 and port 80).

pawel_jakacki_7

Nimbostratus

Dec 04, 2012

yes, curl returns correct value


HTTP/1.1 200 OK
Date: Tue, 04 Dec 2012 15:21:34 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
Set-Cookie: ASP.NET_SessionId=qoh51h55bxp2hv55gpzyamug; path=/; HttpOnly
Cache-Control: private
Content-Type: text/html; charset=utf-8
Content-Length: 1951








    


    


        Status
        
            0

but in ssldump I'm receiving HTTP 500


1354634497.7469 (0.0013)  S>C
---------------------------------------------------------------
HTTP/1.1 500 Internal Server Error
Connection: close
Date: Tue, 04 Dec 2012 15:21:40 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
Cache-Control: private
Content-Type: text/html; charset=utf-8
Content-Length: 3565


    
        Object reference not set to an instance of an object.
        
    

    

            Server Error in '/' Application.

             Object reference not set to an instance of an object. 

            

      ---------------------------------------------------------------

1354634497.7470 (0.0000)  S>C
---------------------------------------------------------------
       Description: An unhandled exception occurred during the execution of the current web request. Please review the stack trace for more information about the error and where it originated in the code.

~~The same output as in ssldump I've received when used telnet 10.x.x.101 80 and typed GET /IsAlive.aspx~~

nitass

Employee

Dec 04, 2012

can you try this? please correct ip address in host header.

GET /IsAlive.aspx HTTP/1.1\r\nUser-Agent: curl/7.19.7 (i686-redhat-linux-gnu) libcurl/7.19.7 OpenSSL/0.9.8u zlib/1.2.3 libidn/0.6.5\r\nHost: 10.x.x.101\r\nAccept: */*\r\n\r\n

pawel_jakacki_7
Nimbostratus
Dec 04, 2012
Posted By nitass on 12/04/2012 07:30 AM
can you try this? please correct ip address in host header.

GET /IsAlive.aspx HTTP/1.1\r\nUser-Agent: curl/7.19.7 (i686-redhat-linux-gnu) libcurl/7.19.7 OpenSSL/0.9.8u zlib/1.2.3 libidn/0.6.5\r\nHost: 10.x.x.101\r\nAccept: */*\r\n\r\n

Now I can see the proper output in tcpdump either ssldump. Now the only thing that I should have to do is correct the regexp, because previous one does not work.
Nitass, thank you for help!!
pawel_jakacki_7
Nimbostratus
Dec 04, 2012
This regexp works fine

Status\s*\s*0\s*

many thanks again Nitass for your help

Regards

Paul

Forum Discussion

Problem with IIS monitoring

18 Replies

Recent Discussions

What happens if I only enable ASM in BIG-IP Under System > Resource Provisioning

URL

Migration from i series 10200 with 1 child VCMP to r series 10900 series

Azure DP-100 Exam Questions

Deploying F5 WAF in front of Azure Web App Services

Related Content

Monitor problem

Health monitor question

F5 Distributed Cloud - Regional Edge Health Monitoring Insights

Source_Addr Persistence Problems

iRule based RADIUS Health Monitor Builder