Smarter by Design.Simpler for Business
gtm hc
The gtm hc command manages the health checks GTM uses to monitor the data centers and the targets. The check results become an input to the scenarios; and the scenarios determine whether the DNS records will take part in the answer or not. Its panel equivalent is the Health Checks screen.
Command Summary
admin@TR7LBWAF01> gtm hc list # list them all
admin@TR7LBWAF01> gtm hc show <id> # show one
admin@TR7LBWAF01> gtm hc add name <name> checkType <type> … # a new check
admin@TR7LBWAF01> gtm hc update id <id> … # change
admin@TR7LBWAF01> gtm hc delete <id> # delete
admin@TR7LBWAF01>
Writing Order
Step 1 Write the name
gtm hc add name web-checkStep 2 Select the check type
checkType httpIt takes fifteen values. After the type is selected, only the fields of that type are asked for.
Step 3 Write the required fields of the type
In most of the types the address and the port to be checked; in the types that have authentication, additionally the user and the password.
Step 4 Add the thresholds and the details
The trial interval, the timeout and the numbers of consecutive results needed for a state change are optional.
Required Fields
The CLI asks for the required fields in the following order, one by one; it does not show the next one before one is written. What comes after the third order changes according to the selected check type.
| Order | Field | Status | Value |
|---|---|---|---|
| 1 | name | Required | The name of the check |
| 2 | checkType | Required | One of the fifteen types below |
| 3 | addr.ip | Conditionally required | In all the types other than dcCheck; the address to be checked. It is written without a prefix even if there is a -- on the line |
| 4 | addr.port | Conditionally required | In the types other than ping and dcCheck; the port to be checked |
| 5 | query | Conditionally required | Only dns; the name to be queried |
| 5 · 6 | ftpUser · ftpPassword | Conditionally required | Only ftp and ftps; the password is asked for hidden after the command |
| 5 · 6 | ldapUsername · ldapPassword | Conditionally required | Only ldap and ldaps; the password is written on the line |
| 5–7 | oracleUser · oraclePassword · oracleConnectionString | Conditionally required | Only oracle; the password is asked for hidden after the command |
| 3 | dcId | Conditionally required | Only dcCheck; the data center whose measure will be taken |
| 4 | criterion.val | Conditionally required | Only dcCheck; the comparison value. It is written without a prefix even if there is a -- on the line |
| 5 | poolId | Conditionally required | Only dcCheck and in the criteria bound to a vService; the vService to be measured |
The -- writing: If there is no field that starts with -- on the line, all the fields in the table are written without a prefix. When a -- field is added to the line, the conditionally required fields (addr.port, query, ftpUser, ldapUsername, ldapPassword, oracleUser, oracleConnectionString, dcId, poolId) are written with the -- prefix; addr.ip and criterion.val, on the other hand, are again without a prefix and have to be written before the fields that start with --.
The Check Types
checkType | It checks | The additional required fields |
|---|---|---|
ping | The reachability of the address | — (the port is not asked for) |
tcp · tcps | Whether a connection can be set up | addr.port |
udp | The UDP target | addr.port |
http · https | The web server answer | addr.port |
dns | The DNS server answer | addr.port · query |
ftp · ftps | The FTP session | addr.port · ftpUser · ftpPassword |
ldap · ldaps | The directory connection | addr.port · ldapUsername · ldapPassword |
smtp · smtps | The mail server | addr.port |
oracle | The database connection | addr.port · oracleUser · oraclePassword · oracleConnectionString |
dcCheck | The measures of a data center | dcId · criterion.val (+ poolId in the vService criteria) |
Some of the passwords are asked for hidden
The oraclePassword and ftpPassword are not written on the command line; after the command is run, they are asked for on the screen without being seen. The ldapPassword, on the other hand, is written directly on the line and falls into the command history.
The Common Fields
| Field | Default | Value |
|---|---|---|
addr.ip | — | The address to be checked (required in all the types other than dcCheck) |
addr.port | — | The port to be checked (required except in ping and dcCheck) |
--testInterval | 1 | The repetition interval of the check |
--timeout | 1 | The duration to be waited for an answer |
--requiredSuccess | 3 | The consecutive successes needed to pass to healthy |
--requiredFailure | 2 | The consecutive failures needed to pass to unhealthy |
--negate | false | It negates the result: a failure counts as healthy |
--v-device · --namespace | The Host device · the default route table | From which context the check will be done |
The --v-device, --namespace, --testInterval and --timeout fields are not present in the dcCheck type.
The HTTP and HTTPS Check
| Field | Default | Value |
|---|---|---|
--uri | — | The path and the query to be requested |
--method | GET | The request method |
--httpVersion | 1.1 | 1.1 or 2 |
--httpBody | — | The request body |
--httpHeaders.0.name · --httpHeaders.0.value | — | The request headers |
--expectedStatusCodes.0 | 200 | The status codes that count as a success |
--contentCheckMode | basic | The content check form: basic or jsonata |
--virtualDomain | — | The domain name to be sent as the Host and the SNI |
--verifyCertificate | false | It verifies the server certificate |
--contentQuery | — | The text to be searched for in the answer body; it is used while --contentCheckMode basic |
--jsonataQuery | — | The JSONata expression that will check the answer body; it is used while --contentCheckMode jsonata |
--tlsClientCert | — | The client certificate to be presented in the mutual authentication |
--tlsVerifyCa | — | The CA profile against which the server certificate will be verified; it opens only while --verifyCertificate true |
The certificate fields can be used in the https, tcps, smtp, smtps, ftps and ldaps types as well.
The DNS Check
| Field | Default | Value |
|---|---|---|
query | — | The name to be queried |
--reverseDns | false | It queries the PTR record instead of the address; when it is turned on, the record type is not asked for |
--rrType | A | The record type to be queried: A · AAAA · CAA · CNAME · MX · NAPTR · NS · PTR · SOA · SRV · TXT. It does not open while --reverseDns true |
--dnsExpectType | none | How the answer will be checked: none · text · regex |
dnsTextToExpect · dnsRegexToExpect | — | The expected answer; one of them becomes required according to the selected check form |
The Checks with Scenario Steps
In the tcp, tcps, udp and oracle types the check consists of steps that run in order. Every step takes its own index: in the --tcpScenario.0.…, --tcpScenario.1.… form. First what the step will do is selected, then the fields of that step are written.
tcp and tcps
| Field | What it does | What is written after it |
|---|---|---|
--tcpScenario.N.tcpAction | Selects what the step will do | sendText sends data · expectText expects text · expectRegex expects a regular expression · wait waits |
--tcpScenario.N.textToSend | Writes the data to be sent | The text to be sent; it opens while tcpAction sendText |
--tcpScenario.N.dataFormat | Selects the format of the sent data | text (default) · hex · base64; it opens while tcpAction sendText |
--tcpScenario.N.textToExpect | Writes the text to be searched in the response | The expected text; it opens while tcpAction expectText |
--tcpScenario.N.regexToExpect | Writes the regular expression to be searched in the response | A regular expression; it opens while tcpAction expectRegex |
--tcpScenario.N.tcpWaitMs | Determines how long the step will wait | Milliseconds; it opens while tcpAction wait |
udp
| Field | What it does | What is written after it |
|---|---|---|
--udpScenario.N.udpAction | Selects what the step will do | send sends data · wait waits · expectText expects text · expectRegex expects a regular expression |
--udpScenario.N.dataToSend | Writes the data to be sent | The data to be sent; it opens while udpAction send |
--udpScenario.N.dataFormat | Selects the format of the sent data | text (default) · hex · base64; it opens while udpAction send |
--udpScenario.N.textToExpect | Writes the text to be searched in the response | The expected text; it opens while udpAction expectText |
--udpScenario.N.regexToExpect | Writes the regular expression to be searched in the response | A regular expression; it opens while udpAction expectRegex |
--udpScenario.N.udpWaitMs | Determines how long the step will wait | Milliseconds; it opens while udpAction wait |
oracle
| Field | What it does | What is written after it |
|---|---|---|
--oracleScenario.N.oracleAction | Selects what the step will do | executeCmd runs a query · wait waits |
--oracleScenario.N.oracleCmd | Writes the query to be run | An SQL statement; it opens while oracleAction executeCmd |
--oracleScenario.N.oracleExpectedText | Writes the text to be searched in the result | The expected text; it opens while oracleAction executeCmd |
--oracleScenario.N.oracleExpectedMinRows | Determines at least how many rows the result has to return | The number of rows; it opens while oracleAction executeCmd |
--oracleScenario.N.oracleWaitMs | Determines how long the step will wait | Milliseconds; it opens while oracleAction wait |
The FTP, SMTP and LDAP Checks
| Field | What it does | What is written after it |
|---|---|---|
ftpUser · ftpPassword | Carries the credentials that will open the FTP session | The user name and the password; they are required in the ftp and ftps types |
--ftpAction | Selects how far the check will go | onlyLogin only opens a session (default) · loginAndList lists the directory as well |
--ftpPath | Determines the directory to be listed | The path on the server; it is written in the ftp and ftps types |
--smtpHelo | Determines the EHLO name to be sent to the server | A domain name; it is written in the smtp and smtps types |
--smtpStartTls | Turns on the encryption of the connection with STARTTLS | true · false (default false); it opens only in the smtp type |
ldapUsername · ldapPassword | Carries the credentials that will connect to the directory | The user name and the password; they are required in the ldap and ldaps types |
--ldapAuth | Turns on not only the connection but also the authentication being tried | true · false (the default is false); it is written in the ldap and ldaps types |
The Data Center Check
The dcCheck type is not bound to a target; it compares the measures of the selected data center with a threshold.
| Field | Default | Value |
|---|---|---|
dcId | — | The data center whose measure will be taken; if there is a -- field on the line, --dcId is written |
--dcCheckType | pool_status | Which measure will be taken |
poolId | — | Required in the vService criteria; the vService to be measured. If there is a -- field on the line, --poolId is written |
criterion.val | — | The comparison value; under every condition it is without a prefix and is written before the -- fields |
--criterion.op | > | The comparison operator: >, <, = or - for a range. Since it contains a sign, it is written with double quotes |
--criterion.val2 | — | The upper limit of the range; it is used only when --criterion.op "-" is written |
The --dcCheckType values: pool_status, pool_session_new, pool_request, pool_connection, pool_cpu, pool_bw, cpu, bw, upPools, downPools. The first six are bound to a vService and ask for poolId.
Examples
admin@TR7LBWAF01> gtm hc add name web-tcp checkType tcp addr.ip 10.0.0.10 addr.port 443
# in the ping type the port is not asked for
admin@TR7LBWAF01> gtm hc add name net-ping checkType ping addr.ip 10.0.0.1
admin@TR7LBWAF01>
admin@TR7LBWAF01> gtm hc add name portal-https checkType https addr.ip 10.0.0.10 --addr.port 443 \
--uri /health --expectedStatusCodes.0 200 --virtualDomain portal.kurum.com.tr \
--verifyCertificate true --timeout 3
admin@TR7LBWAF01>
admin@TR7LBWAF01> gtm hc add name dns-check checkType dns addr.ip 10.0.0.53 --addr.port 53 \
--query www.kurum.com.tr --rrType A
# in the ftp type the password is asked for after the run
admin@TR7LBWAF01> gtm hc add name ftp-check checkType ftp addr.ip 10.0.0.21 addr.port 21 ftpUser check
FTP password: ••••••••
admin@TR7LBWAF01>
# unhealthy if the vService processor usage exceeds 80%
admin@TR7LBWAF01> gtm hc add name dc-cpu checkType dcCheck criterion.val 80 \
--dcId <center> --poolId <vService> --dcCheckType pool_cpu --criterion.op ">"
admin@TR7LBWAF01>
Updating and Deleting
admin@TR7LBWAF01> gtm hc update id <id> --testInterval 5 --requiredFailure 3
admin@TR7LBWAF01> gtm hc update id <id> --httpHeaders.delete # remove the headers
admin@TR7LBWAF01> gtm hc delete <id>
admin@TR7LBWAF01>
Things to Know
- A check does not give a decision on its own. Unless its result is bound to a scenario, it does not affect the DNS answers; the scenarios are set up with
gtm scenario. - The thresholds are two-way. Three consecutive results for the passage to healthy and two for the passage to unhealthy are the default; the two are set separately.
- The comparison operator requires quotes. Since the
--criterion.opvalues contain signs such as>, they are written with double quotes. dcCheckdoes not carry the context fields. In this type the virtual device, route table, interval and timeout fields are not present.
