Remover APM Session after send response for user

Interesting topic. Unfortunately I don't have a solution, but I am going to do a similar thing very soon. Since I also don't have enough APM sessions (20K), I'm going to only activate APM when a login is requested by the back-end webservers. After logging in I delete the APM session.

This works in test, but has not been battle tested.

When I put it in production and find useful info regarding your question, I'll come back.

Interesting topic. Unfortunately I don't have a solution, but I am going to do a similar thing very soon. Since I also don't have enough APM sessions (20K), I'm going to only activate APM when a login is requested by the back-end webservers. After logging in I delete the APM session.

This works in test, but has not been battle tested.

When I put it in production and find useful info regarding your question, I'll come back.

I thought of something you could try. In your code, you delete the APM session yourself. Might it be an option to let APM clean up its own sessions? Maybe it knows better what to delete because its the "cleanup" process. I know you have a session limit to monitor, but you set the timeout very short.

Edit: you might have to set this during creation of the APM session, because when I tried this:

when HTTP_RESPONSE { ACCESS::session data set session.inactivity_timeout 30}

it didn't work. It seems you can't update inactivity_timeout after an APM session is complete and allowed.

So either you set it for the global APM Policy, or you could use an event in your APM flow that sets the timeout based on other parameters.

when ACCESS_POLICY_AGENT_EVENT { switch [ACCESS::policy agent_id] { "set_session_inactivity_timeout { if {...} { ACCESS::session data set session.inactivity_timeout ...} } } }

I thought of something you could try. In your code, you delete the APM session yourself. Might it be an option to let APM clean up its own sessions? Maybe it knows better what to delete because its the "cleanup" process. I know you have a session limit to monitor, but you set the timeout very short.

Edit: you might have to set this during creation of the APM session, because when I tried this:

when HTTP_RESPONSE { ACCESS::session data set session.inactivity_timeout 30}

it didn't work. It seems you can't update inactivity_timeout after an APM session is complete and allowed.

So either you set it for the global APM Policy, or you could use an event in your APM flow that sets the timeout based on other parameters.

when ACCESS_POLICY_AGENT_EVENT { switch [ACCESS::policy agent_id] { "set_session_inactivity_timeout { if {...} { ACCESS::session data set session.inactivity_timeout ...} } } }

You can try something like that

when ACCESS_ACL_ALLOWED {
    set close_response 1
}

when HTTP_RESPONSE { 
    if {$close_response} {    
        ACCESS::session remove         
    }    
}

Be careful, I do it and it works when I have 1 request per time (in lab test), but when I have load in envirement the F5 close wrong sessions.

You can test it using JMeter for put many request in your envirement in the same time.

Be sure to check my answer, it might work better because APM can clean up its own sessions "the normal way"

Be sure to check my answer, it might work better because APM can clean up its own sessions "the normal way"

Sorry, I undertud wrong. You don't force the session close. In my case I need authetication in all calls.

I saw the wireshark package and my client is using the same TCP Connection to open different session. When the F5 close session, it is closing the TCP Connection too and it cause error in my client in another session (because the session use the same TCP Connection).

Can I remove session without close TCP Connection? Or Can I close all session when the TCP Connection has finished?