Forum Discussion

BrianG_11931's avatar
BrianG_11931
Icon for Nimbostratus rankNimbostratus
May 23, 2014

Extended Content Verification (ECV) Content Check HTTP Health Monitor Receive String (2)

Hello, I created an Extended Content Verification (ECV) Content Check Health Monitor to test server-specific content returned from a web server query, but it's currently not working (never has), and my pool and pool members are in an "Offline (Enabled)" state still.

 

There is URL redirection going on in the following order of the Send Strings I have tried, so I'm not sure if that's preventing this monitor from working, but I've tested each of these, including testing "Host: BIG-IP" which was required on a previous health monitor:

 

Send String: "GET / HTTP/1.1\r\nHost: \r\nConnection: Close\r\n\r\n" Send String: "GET /Login.htm?ReturnUrl=%2fpages%2ffscremote.htm HTTP/1.1\r\nHost: \r\nConnection: Close\r\n\r\n" Send String: "GET /Login.htm?ReturnUrl=%2fpages%2ffscremote.htm&AspxAutoDetectCookieSupport=1 HTTP/1.1\r\nHost: \r\nConnection: Close\r\n\r\n"

 

I ran 'curl -v http://SERVER/...' with each of the previous Send Strings and the following is text seen respectively in the output of the curl command that I believe I can place in the Receive String field:

 

Receive String: "200 OK" Receive String: "302 Found" Receive String: "302 Found"

 

Nothing has worked. Any suggestions from the gurus? I'd rather not use just an icmp health monitor.

 

application delivery
availability
deployment
LTM

12 Replies

Sort By
  • nitass's avatar
    nitass
    Icon for Employee rankEmployee
    May 27, 2014

    can you try tcpdump on bigip?

     tcpdump -nni 0.0:nnn -s0 -w /var/tmp/output.pcap host x.x.x.x and host y.y.y.y and port zzz -v

x.x.x.x is non-floating self ip on server vlan
y.y.y.y is server ip
zzz is server port
    • BrianG_11931's avatar
      BrianG_11931
      Icon for Nimbostratus rankNimbostratus
      May 27, 2014
      Thanks. I ran the command, but since the Health Monitor isn't working, would I expect any traffic to be processed? I currently don't see any traffic processing. Also, how long should I run the dump?
  • nitass_89166's avatar
    nitass_89166
    Icon for Noctilucent rankNoctilucent
    May 27, 2014

    can you try tcpdump on bigip?

     tcpdump -nni 0.0:nnn -s0 -w /var/tmp/output.pcap host x.x.x.x and host y.y.y.y and port zzz -v

x.x.x.x is non-floating self ip on server vlan
y.y.y.y is server ip
zzz is server port
    • BrianG_11931's avatar
      BrianG_11931
      Icon for Nimbostratus rankNimbostratus
      May 27, 2014
      Thanks. I ran the command, but since the Health Monitor isn't working, would I expect any traffic to be processed? I currently don't see any traffic processing. Also, how long should I run the dump?
  • nitass's avatar
    nitass
    Icon for Employee rankEmployee
    May 28, 2014

    but since the Health Monitor isn't working, would I expect any traffic to be processed?

     

    yes, monitor should keep sending traffic at every interval.

     

    I currently don't see any traffic processing. Also, how long should I run the dump?

     

    is tcpdump filter correct? you may try to alter filter (e.g. remove non-floating self ip, remove port, etc) to see if you can get traffic.

     

  • BrianG_11931's avatar
    BrianG_11931
    Icon for Nimbostratus rankNimbostratus
    May 28, 2014

    Thanks. I removed the non-floating Self IP on server VLAN and I'm now seeing packets getting captured. Packet analysis showed "400 Bad Request" & "Bad Request - Invalid Header" messages, but I'm not an expert at reading packets. For the IIS server we use Host Headers to direct to the correct virtual website, so I updated the monitor this timeto use a Host Header identical to the Host Header binding, but I'm still getting the same errors.

     

    Also, when I run 'curl', it's taking almost 1min to get results back so I increased the Interval and Timeout values to be 60sec, which I'm guessing is required, but this didn't fix anything.

     

    Do you have any more feedback?

     

  • nitass's avatar
    nitass
    Icon for Employee rankEmployee
    May 29, 2014

    Packet analysis showed "400 Bad Request" & "Bad Request - Invalid Header" messages, but I'm not an expert at reading packets.

     

    you may try tcpdump when using curl and compare with the health monitor's tcpdump. look for request packet and see what difference is. then modify the health monitor send string accordingly.

     

    • BrianG_11931's avatar
      BrianG_11931
      Icon for Nimbostratus rankNimbostratus
      May 29, 2014
      Hello, I ran a tcpdump on the BIG-IP while also running a curl on the BIG-IP. I didn't see anything more helpful except I see both an "HTTP/1.1 400 Bad Request" and an "HTTP/1.1 302 Found" in the same capture. I don't know what you want me to compare with a previous tcpdump of just a health monitor's traffic as they look the same to me. What does a "request packet" look like and if I use Wireshark to look at the capture, where should I be looking in the packet for data to compare? Thanks
  • nitass_89166's avatar
    nitass_89166
    Icon for Noctilucent rankNoctilucent
    May 29, 2014

    Packet analysis showed "400 Bad Request" & "Bad Request - Invalid Header" messages, but I'm not an expert at reading packets.

     

    you may try tcpdump when using curl and compare with the health monitor's tcpdump. look for request packet and see what difference is. then modify the health monitor send string accordingly.

     

    • BrianG_11931's avatar
      BrianG_11931
      Icon for Nimbostratus rankNimbostratus
      May 29, 2014
      Hello, I ran a tcpdump on the BIG-IP while also running a curl on the BIG-IP. I didn't see anything more helpful except I see both an "HTTP/1.1 400 Bad Request" and an "HTTP/1.1 302 Found" in the same capture. I don't know what you want me to compare with a previous tcpdump of just a health monitor's traffic as they look the same to me. What does a "request packet" look like and if I use Wireshark to look at the capture, where should I be looking in the packet for data to compare? Thanks
  • BrianG_11931's avatar
    BrianG_11931
    Icon for Nimbostratus rankNimbostratus
    May 29, 2014

    Yes, I ran a tcpdump on the BIG-IP while also running a curl on the BIG-IP. Correct, I do not get a "400 Bad Request" when using curl or the browser. Here is my Send String again: "GET /Login.htm?ReturnUrl=%2fpages%2ffscremote.htm&AspxAutoDetectCookieSupport=1 HTTP/1.1\r\nHost: SERVER\r\nConnection: Close\r\n\r\n", replacing "SERVER" with blank, BIG-IP, the NetBIOS name of the server, the FQDN of the server, and the DNS alias for the service running on this server.

     

  • BrianG_11931's avatar
    BrianG_11931
    Icon for Nimbostratus rankNimbostratus
    Jul 07, 2014

    Turned out that we needed to specify a host name and have that host name bound to the web server website. This is the first time I had to do that.