Disk space full
Hi Team, recently on my F5 appears this error : Disk partition / has only 1% free I have deleted some old files, I removed ucs backup and save it from another device, but the problem was not fixed yet. The message appaers continuatively... Filesystem Size Used Avail Use% Mounted on /dev/mapper/vg--db--sda-set.2.root 427M 399M 5.3M 99% / Someone could help me to fix it ? Many thanks in advanced . Rgds,Solved3.6KViews0likes4CommentsTraffic Policies using tcl
Trying to using the tcl variables within the log message so can log information such as client address and uri. i put the following into log message text box, but does work. The user was redirected fromtcl:[HTTP::uri] and Client IP tcl:[IP::client_addr]3.5KViews0likes1CommentUDP Datagram LB
Hello, To enable fair load balancing between backend servers (5 syslog srv >> F5 >> 2 splunk srv) I created a new udpprofile and activated the option :"Datagram LB" :https://support.f5.com/csp/article/K3605 100% of logs received with the default udp profile, but not with the new profile udp (the other parameters are equal) an idea? Thanks!Solved3.2KViews0likes8CommentsiRules Can't call after responding - ERR_NOT_SUPPORTED (line 1) invoked from within "HTTP::host"
Hi, I tried to write a irule that can response code 200 and some contenet when the query string matched. But I found the error log as below : TCL error: /Common/fz_stg_base <HTTP_REQUEST> - Can't call after responding - ERR_NOT_SUPPORTED (line 1) invoked from within "HTTP::host" My irules as below : when HTTP_REQUEST { switch -regexp [HTTP::query] { "jsonp=NetTestCallback[0-8]&.+" { HTTP::respond 200 content "Hello World!!" } } } /Common/fz_stg_company irule as below : when HTTP_REQUEST { switch -glob [string tolower [HTTP::host]] { "a.bc.xyz" {pool my_pool} } } My irules on the top order andfz_stg_company on the second order. Any idea?Solved3.1KViews0likes3CommentsPool Members with multiple ports
got a customer who wants to have the Pool members on multiple ports. Client --->Virtual server:https --->Pool members on ports 30000-32676. Listing the * or 0 for ports on the pool members will not work as the traffic could be sent to any port from the F5, but since the virtual server is listening on 443 it will just send to the backend servers on 443.Solved2.6KViews0likes2CommentsC3D and header insert
Have a F5 that is a WAF so is performing the break and inspect on user web traffic sending through the ASM module. Since the customers backend requires a user certificate I explained to the user there are two options that can be utilized. Option 1 (preferred) the F5 prompts the user for their certificate, then the F5 performs a header insert to the backend systems (Apache) and then it is up to the customer to extract the certificate from the incoming packets. The user certificate will be the original user certificate (not modified). The backend servers must not send the "certificate request" or else the SSL negotiation will be terminated because the F5 will send a self signed cert. Option 2 (less preferred) is C3D. The customer puts the F5 certificate that will be used for signing into their backend store as a trusted CA. When the user connects the F5 prompts the user for their certificate. Then the F5 communicates to the backend server and the backend send the "certificate request". F5 will resign the user certificate and send the certificate with the F5 being the certificate signer. Customer said their Apache must prompt for the certificate, so have C3D setup on the F5 and the F5 is sending the resigned user certificate. When the customer Apache server sends that resigned certificate to the Oracle backend the Oracle refuses the certificate because the customer is storing the original user certificate in the Oracle backend. I asked why does the Oracle backend need the full certificate, the Oracle can be configured to just use the CN from the certificate. Customer answer is because that is how it works. So now the customer wants to utilize C3D and have the F5 perform a header insert of the user original certificate, I am not sure if that can be done. Even then just does not make any sense and makes things more complicated than required.Solved2.2KViews0likes6CommentsUse the REST proxy on the BIG-IQ system ERROR
Hello, I'm working in a local environment trying to use the REST proxy on the BIG-IQ system with the objective of acquire certain info of a BIG-IP. Once I've obtained the BIG-IQ token, discovered the BIG-IP device, enabled the REST-PROXY feature and obtained the BIG-IP uuid (4ad12733-95ea-47b0-a562-dd6ac6da5adc), which basically consists on following the steps found on that websiteEnabling BIG-IQ Centralized Management as a REST proxy for BIG-IP devices (f5.com);it is time to confirm that the BIGIP has been discovered and included into the BIGIP devices group with the code below. headers = { 'X-F5-Auth-Token': f'{token}' } # Request to confirm that the BIGIP was discovered and is included in the cm-bigip-allDevices group url_id = "https://192.168.1.44/mgmt/shared/resolver/device-groups/cm-bigip-allDevices/devices/4ad12733-95ea-47b0-a562-dd6ac6da5adc" response_id = requests.get(url_id, auth=HTTPBasicAuth('admin', 'psw'), headers=headers, verify=False) The problem is that whenI execute that, there is an output variable that states that "state": "PENDING", when that should be "state": "ACTIVE".Why? Do I left something? Am I doing something wrong? Thanks in advanceSolved2.1KViews0likes5CommentsiRule [string range...] not chunking data properly
I have an irule (much of which I found here) that is to gather some much needed troubleshooting data I need in regards to the headers and payload I have coming in. The payload is obvisouly too large for a single log line so this was supposed to chunk it into manageable bytes. I had to make some modifications to the original irule which did not work, but now it is working, sort of. It logs the first 900 bytes as it should, then something happens and skips a bunch, and then logs the final bytes of data. I can't understand why it's not grabbing either the proper amount of data or failing to output this second chunk of missing data before making its final loop. iRule is here: when RULE_INIT { # Log debug to /var/log/ltm? 1=yes, 0=no set static::payload_dbg 1 # Limit payload collection to 5Mb set static::max_collect_len 5368709 # Max characters to log locally (must be less than 1024 bytes) # https://clouddocs.f5.com/api/irules/log.html set static::max_chars 900 set static::min_chars 0 } when HTTP_REQUEST { # Only collect POST request payloads if {[HTTP::method] equals "POST"}{ if {$static::payload_dbg}{log local0. "POST request"} # Get the content length so we can request the data to be processed in the HTTP_REQUEST_DATA event. if {[HTTP::header exists "Content-Length"]}{ set content_length [HTTP::header "Content-Length"] } else { set content_length 0 } # content_length of 0 indicates chunked data (of unknown size) if {$content_length > 0 && $content_length < $static::max_collect_len}{ set collect_length $content_length } else { set collect_length $static::max_collect_len } if {$static::payload_dbg}{log local0. "Content-Length: $content_length, Collect length: $collect_length"} foreach aHeader [HTTP::header names] { log local0. "HTTP Request Headers: $aHeader: [HTTP::header value $aHeader]" } #set payload [HTTP::collect $collect_length] HTTP::collect $collect_length } } when HTTP_REQUEST_DATA { # Log the bytes collected if {$static::payload_dbg}{log local0. "Collected [HTTP::payload length] bytes"} # Log the payload locally if {[HTTP::payload length] < $static::max_chars}{ log local0. "Payload=[HTTP::payload]" } else { # Initialize variables set remaining [HTTP::payload] set position 0 set count 1 set bytes_logged 0 # Loop through and log each chunk of the payload while {[string length $remaining] > $static::min_chars}{ #chunk = 899 set chunk [expr {$position + $static::max_chars -1}] log local0. "Chunk: $chunk" log local0. "Position start: $position" # Get the current chunk to log (subtract 1 from the end as string range is 0 indexed) set current [string range $remaining $position $chunk] log local0. "chunk $count=$current" log local0. "Current chunks bytes: [string length $current]" # Add the length of the current chunk to the position for the next chunk incr position [string length $current] # Get the next chunk to log set remaining [string range $remaining $position end] incr count incr bytes_logged $position log local0. "remaining bytes=[string length $remaining], \$position=$position, \$count=$count, \$bytes_logged=$bytes_logged" } if {[string length $remaining]}{ log local0. "chunk $count=$current" incr bytes_logged [string length $remaining] } log local0. "Logged $count chunks for a total of $bytes_logged bytes" } } when HTTP_RESPONSE { foreach aHeader [HTTP::header names] { log local0. "HTTP Request Headers: $aHeader: [HTTP::header value $aHeader]" } } The image below shows what I'm talking about - it even says "Oh I found 3 chunks", but I'm only being presented 2. I added some logging around the position, chunk value (aka end position), and bytes logged to help illustrate that it's clearly skipping over something. Any help would be appreciated! ThanksSolved2.1KViews0likes6CommentsSSL Certificate Alerts via Email
Hello, This is my first post here and I am relatively new to this and have been lightly working with the f5 for a few years but nothing to this extent. I am trying to setup receiving emails for when my certificates are about to expire. I am trying to run this on a weekly basis using cron. I have followed: https://community.f5.com/t5/crowdsrc/ssl-certicate-report/ta-p/278398 I am able to receive emails when doing the following command: echo "Automated SSL Certificate Report" | mail -vs "Test Email for Automated SSL Certificate Report"my@email.com When I try to run my script I am not able to recieve and email and not getting anything back. Here is what I have so far: Command: tmsh edit cli script certificatereport.tcl Output: modify script certificatereport.tcl { proc script::run {} { # Iterate through certs in files set hostname [exec {/bin/hostname}] set reportdate [exec {/bin/date}] puts "---------------------------------------------------------------------" puts "Certificate report for BIG-IP $hostname " puts "Report Date: $reportdate" puts "---------------------------------------------------------------------" puts "\n\n" set certcount 0 set certproblems 0 set certwarnings 0 foreach file [glob -directory /config/filestore/files_d/Common_d/certificate_d/ * ] { incr certcount # Get Certificate Subject set cn [lindex [split [exec "/usr/bin/openssl" "x509" "-in" $file "-subject" "|" "grep" "subject"] "=" ] end] set start [lindex [split [exec "/usr/bin/openssl" "x509" "-in" $file "-startdate" "|" "grep" "Before"] '='] 1] set stop [lindex [split [exec "/usr/bin/openssl" "x509" "-in" $file "-enddate" "|" "grep" "After"] '='] 1] # Clean up bad X509 date fields removing multiple spaces before tokenizing them regsub -all -- {[[:space:]]+} $start " " start regsub -all -- {[[:space:]]+} $stop " " stop set startparts [split $start] set stopparts [split $stop] set activatedseconds [expr {[clock scan "[lindex $startparts 0] [lindex $startparts 1], [lindex $startparts 3]"] - [clock seconds]}] set expiredseconds [expr {[clock seconds] - [clock scan "[lindex $stopparts 0] [lindex $stopparts 1], [lindex $stopparts 3]"]}] # Date Math if { $activatedseconds > 0 } { puts "File: $file" puts "\tCN: $cn certificate" puts "\tError: certificate is not valid yet. It will be valid on $start." puts "\tActivates in: [expr {$activatedseconds / 86400}] days." puts "---------------------------------------------------------------------" incr certproblems #} elseif { $expiredseconds > 0 } { # puts "File: $file" # puts "\tCN: $cn certificate" # puts "\tError: is not valid because it HAS EXPIRED on $stop." #puts "\tEXPIRED: [expr {$expiredseconds / 86400}] days ago." #puts "---------------------------------------------------------------------" #incr certproblems } elseif { [expr {$expiredseconds * -1}] < 2629743 } { # All certs that will expire within this month puts "File: $file" puts "\tCN: $cn certificate" puts "\tError: WILL EXPIRE ON $stop." puts "\tWILL EXPIRE IN: [expr {$expiredseconds / -86400}] days." puts "---------------------------------------------------------------------" incr certwarnings } } puts "\n" puts "$certcount Certificates Found" puts "$certproblems Certificate Errors Found" puts "$certwarnings Certificate Warnings Found" } } *Note: I am able to run this using Commandrun cli script certificatereport.tcl and recieve the correct output Command: cat automated_certificate_email.sh Output: tmsh run cli script certificatereport.tcl > /var/tmp/certificate-out.txt from="myf5@domain.com" to="my@email.com" subject="Automated SSL Certificate Report" mail -s "$subject" -r "$from" -a "/var/tmp/certificate-out.txt" "$to" I have not bothered with setup of the crontab configuration yet until I can run the script using the following command and actually receive the email: Command: ./automated_certificate_email.sh *Right now when I run this command it will create a file and put the output in the correct certificate-out.txt and I can view it using cat certificate-out.txtbut it never finishes running and never send the email.Solved2KViews0likes5Comments