TCL errors

Question

Hey Team,We are experiencing some TCL errors with one of our iRules.&nbsp;&nbsp;I didn't build the iRule, but have inherited it from a past engineer, so I don't have a ton of knowledge on the specifics, but I'm wondering if it is something we can discover a fix for:Error:partition1/F5_L4_TCP_IPFIXFeb &nbsp;8 13:52:18 DN-DC3-LTM-02.domainname.com err tmm5[13713]: 01220001:3: TCL error: /partition1/F5_L4_TCP_IPFIX &lt;CLIENT_CLOSED&gt; - can't read "rule1_msg1": no such variable &nbsp; &nbsp; while executing "IPFIX::msg set $rule1_msg1 postOctetTotalCount [IP::stats bytes in]"Feb &nbsp;8 13:52:19 DN-DC3-LTM-02.domainname.com err tmm4[13713]: 01220001:3: TCL error: /partition1/F5_L4_TCP_IPFIX &lt;SERVER_CLOSED&gt; - can't read "rule1_msg1": no such variable &nbsp; &nbsp; while executing "IPFIX::msg set $rule1_msg1 octetTotalCount [IP::stats bytes out]"Feb &nbsp;8 13:52:19 DN-DC3-LTM-02.domainname.com err tmm4[13713]: 01220001:3: TCL error: /partition1/F5_L4_TCP_IPFIX &lt;CLIENT_CLOSED&gt; - can't read "rule1_msg1": no such variable &nbsp; &nbsp; while executing "IPFIX::msg set $rule1_msg1 postOctetTotalCount [IP::stats bytes in]"Feb &nbsp;8 13:52:19 DN-DC3-LTM-02.domainname.com err tmm5[13713]: 01220001:3: TCL error: /partition1/F5_L4_TCP_IPFIX &lt;SERVER_CLOSED&gt; - can't read "rule1_msg1": no such variable &nbsp; &nbsp; while executing "IPFIX::msg set $rule1_msg1 octetTotalCount [IP::stats bytes out]"Feb &nbsp;8 13:52:19 DN-DC3-LTM-02.domainname.com err tmm5[13713]: 01220001:3: TCL error: /partition1/F5_L4_TCP_IPFIX &lt;CLIENT_CLOSED&gt; - can't read "rule1_msg1": no such variable &nbsp; &nbsp; while executing "IPFIX::msg set $rule1_msg1 postOctetTotalCount [IP::stats bytes in]"Feb &nbsp;8 13:52:20 DN-DC3-LTM-02.domainname.com err tmm3[13713]: 01220001:3: TCL error: /partition1/F5_L4_TCP_IPFIX &lt;SERVER_CLOSED&gt; - can't read "rule1_msg1": no such variable &nbsp; &nbsp; while executing "IPFIX::msg set $rule1_msg1 octetTotalCount [IP::stats bytes out]"Feb &nbsp;8 13:52:20 DN-DC3-LTM-02.domainname.com err tmm3[13713]: 01220001:3: TCL error: /partition1/F5_L4_TCP_IPFIX &lt;CLIENT_CLOSED&gt; - can't read "rule1_msg1": no such variable &nbsp; &nbsp; while executing "IPFIX::msg set $rule1_msg1 postOctetTotalCount [IP::stats bytes in]"[user@DN-DC3-LTM-02:Active:In Sync] log #[user@DN-DC3-LTM-02:Active:In Sync] log #&nbsp;IRULE:when RULE_INIT {&nbsp; set static::http_rule1_dest ""&nbsp; set static::http_rule1_tmplt ""}&nbsp;&nbsp;# CLIENT_ACCEPTED event to initiate IPFIX destination and templatewhen CLIENT_ACCEPTED {&nbsp; set start [clock clicks -milliseconds]&nbsp; if { $static::http_rule1_dest == ""} {&nbsp; &nbsp; # open the logging destination if it has not been opened yet&nbsp; &nbsp; set static::http_rule1_dest [IPFIX::destination open -publisher /western-hemisphere/IPFIX-PUB1]&nbsp; }&nbsp; if { $static::http_rule1_tmplt == ""} {&nbsp; &nbsp; # if the template has not been created yet, create the template&nbsp; &nbsp; set static::http_rule1_tmplt [IPFIX::template create "flowStartMilliseconds \&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; sourceIPv4Address \&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; sourceIPv6Address&nbsp; \&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; destinationIPv4Address \&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; destinationIPv6Address&nbsp; \&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; sourceTransportPort \&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; destinationTransportPort \&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; protocolIdentifier \&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; octetTotalCount \&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; packetTotalCount \&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; octetDeltaCount \&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; packetDeltaCount \&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; postNATSourceIPv4Address \&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; postNATSourceIPv6Address&nbsp; \&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; postNATDestinationIPv4Address \&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; postNATDestinationIPv6Address&nbsp; \&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; postNAPTSourceTransportPort \&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; postNAPTDestinationTransportPort \&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; postOctetTotalCount \&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; postPacketTotalCount \&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; postOctetDeltaCount \&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; postPacketDeltaCount \&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; flowEndMilliseconds"]&nbsp; }}&nbsp;&nbsp;# SERVER_CONNECTED event to initiate flow data to Tetration and populate 5 tupleswhen SERVER_CONNECTED {&nbsp; set rule1_msg1 [IPFIX::msg create $static::http_rule1_tmplt]&nbsp; set client_closed_flag 0&nbsp; set server_closed_flag 0&nbsp; IPFIX::msg set $rule1_msg1 flowStartMilliseconds $start&nbsp; IPFIX::msg set $rule1_msg1 protocolIdentifier [IP::protocol]&nbsp;&nbsp; # Clientside&nbsp; if { [clientside {IP::version}] equals "4" } {&nbsp; &nbsp; # Client IPv4 address&nbsp; &nbsp; IPFIX::msg set $rule1_msg1 sourceIPv4Address [IP::client_addr]&nbsp; &nbsp; # BIG-IP IPv4 VIP address&nbsp; &nbsp; IPFIX::msg set $rule1_msg1 destinationIPv4Address [clientside {IP::local_addr}]&nbsp; } else {&nbsp; &nbsp; # Client IPv6 address&nbsp; &nbsp; IPFIX::msg set $rule1_msg1 sourceIPv6Address [IP::client_addr]&nbsp; &nbsp; # BIG-IP IPv6 VIP address&nbsp; &nbsp; IPFIX::msg set $rule1_msg1 destinationIPv6Address [clientside {IP::local_addr}]&nbsp; }&nbsp; # Client port&nbsp; IPFIX::msg set $rule1_msg1 sourceTransportPort [TCP::client_port]&nbsp; # BIG-IP VIP port&nbsp; IPFIX::msg set $rule1_msg1 destinationTransportPort [clientside {TCP::local_port}]&nbsp;&nbsp;&nbsp; # Serverside&nbsp; if { [serverside {IP::version}] equals "4" } {&nbsp; &nbsp; # BIG-IP IPv4 self IP address&nbsp; &nbsp; IPFIX::msg set $rule1_msg1 postNATSourceIPv4Address [IP::local_addr]&nbsp; &nbsp; # Server IPv4 IP address&nbsp; &nbsp; IPFIX::msg set $rule1_msg1 postNATDestinationIPv4Address [IP::server_addr]&nbsp; } else {&nbsp; &nbsp; # BIG-IP IPv6 self IP address&nbsp; &nbsp; IPFIX::msg set $rule1_msg1 postNATSourceIPv6Address [IP::local_addr]&nbsp; &nbsp; # Server IPv6 IP address&nbsp; &nbsp; IPFIX::msg set $rule1_msg1 postNATDestinationIPv6Address [IP::server_addr]&nbsp; }&nbsp; # BIG-IP self IP port&nbsp; IPFIX::msg set $rule1_msg1 postNAPTSourceTransportPort [TCP::local_port]&nbsp; # Server port&nbsp; IPFIX::msg set $rule1_msg1 postNAPTDestinationTransportPort [TCP::server_port]}&nbsp;# SERVER_CLOSED event to collect IP pkts and bytes count on serversidewhen SERVER_CLOSED {&nbsp; set server_closed_flag 1&nbsp; # when flow is completed, BIG-IP to server REQUEST pkts and bytes count&nbsp; IPFIX::msg set $rule1_msg1 octetTotalCount [IP::stats bytes out]&nbsp; IPFIX::msg set $rule1_msg1 packetTotalCount [IP::stats pkts out]&nbsp; # when flow is completed, server to BIG-IP RESPONSE pkts and bytes count&nbsp;&nbsp; IPFIX::msg set $rule1_msg1 octetDeltaCount [IP::stats bytes in]&nbsp; IPFIX::msg set $rule1_msg1 packetDeltaCount [IP::stats pkts in]&nbsp; if { $client_closed_flag == 1} {&nbsp; &nbsp; # send the IPFIX log&nbsp; &nbsp; IPFIX::destination send $static::http_rule1_dest $rule1_msg1&nbsp; }}&nbsp;&nbsp;# CLIENT_CLOSED event to collect IP pkts and bytes count on clientsidewhen CLIENT_CLOSED {&nbsp; set client_closed_flag 1&nbsp; # when flow is completed, client to BIG-IP REQUEST pkts and bytes octetDeltaCount&nbsp; IPFIX::msg set $rule1_msg1 postOctetTotalCount [IP::stats bytes in]&nbsp; IPFIX::msg set $rule1_msg1 postPacketTotalCount [IP::stats pkts in]&nbsp; # when flow is completed, BIG-IP to client RESPONSE pkts and bytes count&nbsp; IPFIX::msg set $rule1_msg1 postOctetDeltaCount [IP::stats bytes out]&nbsp; IPFIX::msg set $rule1_msg1 postPacketDeltaCount [IP::stats pkts out]&nbsp; # record the client closed time in ms&nbsp; IPFIX::msg set $rule1_msg1 flowEndMilliseconds [clock click -milliseconds]&nbsp; if { $server_closed_flag == 1} {&nbsp; &nbsp; # send the IPFIX log&nbsp; &nbsp; IPFIX::destination send $static::http_rule1_dest $rule1_msg1&nbsp; }}&nbsp;

keesvandenbos · Answer

Hi,The error occurs when the rule1_msg1 variable is empty.This could happen if a client doesn't complete the 3way handshake and send a reset. Then the CLIENT_CLOSE event is hit without the client sending any data, leaving rule1_msg1 being never created in the other events.Maybe you can solve this by adding this line in the when RULE_INIT { section
when RULE_INIT {
    set static::http_rule1_dest ""
    set static::http_rule1_tmplt ""
    set rule1_msg1 ""
}
Hope it helps.Cheers,Kees

adick · Answer

Thanks Kees!This seems to be a good solution.&nbsp;&nbsp;Could there be other reasons the CLIENT_CLOSE event could get hit without the client sending data?&nbsp; I'm wondering if this iRule could be causing any problems with the VIPs that it is configured on?&nbsp; I heard from someone when you see TCL errors it usually means the VIP communication was cut off early.Or if because it only triggers on CLIENT_CLOSE maybe it is something where the client already had problems communicating and this is just the error that triggers when there is another issue present.&nbsp;Thanks

f5_design_engineer · Answer

Hi Adick,
&nbsp;
There are many TCL online editors that you can check your code, you can make changes and execute till you find the desired results.https://onecompiler.com/tcl/423z8u753
https://www.tutorialspoint.com/execute_tcl_online.php
https://www.jdoodle.com/execute-tcl-online/
&nbsp;
https://onecompiler.com/tcl/423z8u753https://www.tutorialspoint.com/execute_tcl_online.php
https://www.jdoodle.com/execute-tcl-online/
&nbsp;
Hope this Helps.
&nbsp;
🙏

&nbsp;

keesvandenbos · Answer

Your welcome.CLIENT_CLOSED events gets triggers by the client ending the connection. And yes it is true, any TCL error will cause the Virtual Server to stop processing traffic.
rule1_msg1 not being filled with data (and causing the TCL error) will only happen if a client doesn't send any data after the connection has been created, same for SERVER_CLOSED TCL error. If this irule is attached to a virtual server without a proxy profile (L7 connection) the BIG-IP will create the server connection the moment thhttps://my.f5.com/manage/s/article/K8082e client connection is completed. If the client doesn't send any data, in the end the pool member will close its connection with the BIG-IP.K8082 explains the differences between virtual server types.
It could be a client issue causing these erros' Still it is better to first create an empty variable to make sure you do not run into issues.Cheers,Kees
&nbsp;

Forum Discussion

TCL errors

4 Replies

Recent Discussions

What is the meaning is 52% block in WAF

rewrite Azure AD response for portal access via web portal

AS3 Monitoring multiple ports selectively

Open Redirection Mitigation

Portal Access to HTTPS resources slow

Related Content

K23237429: TCL error: ERR_NOT_SUPPORTED after upgrade to version 14.1.0 or later

Converting TCL-Based iRules to Distributed Cloud Service Policies and L7 Routes

TCL error with an universal irule

F5 Automation - TCL & Bash

F5 Policy using replace with TCL