Smarter by Design.Simpler for Business
lb hc
The lb hc command creates the health checks that measure whether the backends are up or not. A check is bound to a backend or to a backend group; it runs at the determined interval and marks the target as healthy or unhealthy according to the number of consecutive successes or failures. Its panel equivalent is the Health Checks screen.
The first field written is checkType
The protocol of the check is selected first; this selection determines which fields will be asked for. Without the type being written, not even name is listed.
Command Summary
# Tab after the command
admin@TR7LBWAF01> lb hc
add delete list show update update-many
admin@TR7LBWAF01> lb hc list # list all of them
admin@TR7LBWAF01> lb hc show <id> # show one
admin@TR7LBWAF01> lb hc add checkType <type> name <name> …
admin@TR7LBWAF01> lb hc update id <id> … # change
admin@TR7LBWAF01> lb hc update-many target <target> … # bulk change
admin@TR7LBWAF01> lb hc delete <id> # delete
admin@TR7LBWAF01>
Writing Order
Step 1 Select the check type
There are fourteen types:
lb hc add checkType httpStep 2 Write the name
name web-denetimiStep 3 Write the required fields of the type
In DNS the query, in FTP and LDAP the credentials, in Oracle the connection information is asked for.
Step 4 Set the thresholds and bind it to a backend
lb backend update id <backend> --hc <check>Required Fields
| Order | Field | Status | Value |
|---|---|---|---|
| 1 | checkType | Required | tcp · tcps · ping · http · https · dns · ftp · ftps · ldap · ldaps · smtp · smtps · oracle · udp |
| 2 | name | Required | The name of the check |
| 3 | query | Conditionally required | Only dns; the name to be queried |
| 3 · 4 | ftpUser · ftpPassword | Conditionally required | Only ftp and ftps; the password is asked for hidden after the command |
| 3 · 4 | ldapUsername · ldapPassword | Conditionally required | Only ldap and ldaps; the password is written in the line |
| 3–5 | oracleUser · oraclePassword · oracleConnectionString | Conditionally required | Only oracle; the password is asked for hidden after the command |
| — | dnsTextToExpect | Conditionally required | Only when dns and --dnsExpectType text are written; it is written without a prefix right after it |
The check type is a discriminator in this command: the required fields specific to the type are written without a prefix even if there is a field starting with -- in the line, and no field starting with -- is accepted until they are all completed.
The target address of the check is not written in this command: the check uses the address of the backend to which it is bound. If a different address will be checked, it is given in the lb backend record with the --useDifferentIp and --differentIp.ip fields.
The Check Types
checkType | What it does | The required fields specific to the type |
|---|---|---|
tcp | Establishes a TCP connection; a step scenario can be written | — |
tcps | Establishes a TCP connection with TLS | — |
ping | Looks at the reachability with ICMP | — |
http | Sends an HTTP request and checks the response | — |
https | Sends an HTTP request with TLS | — |
dns | Sends a DNS query | query |
ftp | Opens an FTP session | ftpUser · ftpPassword |
ftps | Opens an FTP session with TLS | ftpUser · ftpPassword |
ldap | Connects to the directory | ldapUsername · ldapPassword |
ldaps | Establishes a directory connection with TLS | ldapUsername · ldapPassword |
smtp | Connects to the SMTP server | — |
smtps | Establishes an SMTP connection with TLS | — |
oracle | Connects to the database and can run a query | oracleUser · oraclePassword · oracleConnectionString |
udp | Sends a UDP packet; a step scenario can be written | — |
The Threshold Fields Found in Every Type
| Field | What it does | What is written after it |
|---|---|---|
--testInterval | Determines at which interval the check will be repeated | Seconds (default 1) |
--timeout | Determines how long will be waited for the response | Seconds (default 1) |
--requiredSuccess | Determines the number of consecutive successes required for the target to be counted as healthy | A number (default 3) |
--requiredFailure | Determines the number of consecutive failures required for the target to be counted as unhealthy | A number (default 2) |
--negate | Reverses the result: a failure is counted as healthy | true · false (default false) |
The TLS Fields
It is common in the tcps, https, ftps, ldaps, smtp and smtps types.
| Field | What it does | What is written after it |
|---|---|---|
--virtualDomain | Determines the name to be sent as Host and SNI in the connection | A domain name |
--verifyCertificate | Turns on the verification of the certificate of the server | true · false (default false) |
--tlsVerifyCa | Selects the CA profile to be used in the verification | The lb ca record; it opens only while --verifyCertificate true |
--tlsClientCert | Selects the client certificate to be presented in the mutual verification | A certificate record |
The HTTP and HTTPS Fields
| Field | What it does | What is written after it |
|---|---|---|
--uri | Determines the path and the query to be requested | A path, for example /saglik |
--method | Selects the request method | An HTTP method (default GET) |
--httpVersion | Selects the HTTP version to be used | 1.1 (default) · 2 |
--httpHeaders.N.name · --httpHeaders.N.value | Adds a header to the request | The header name and value; every pair with its own index |
--httpBody | Writes the request body | The body text to be sent |
--expectedStatusCodes.N | Determines the status codes to be counted as a success | A status code (default 200); more than one with its own index |
--contentCheckMode | Selects how the response body will be checked | basic text matching (default) · jsonata expression |
--contentQuery | Writes the text to be searched in the response | The expected text; it is used while --contentCheckMode basic |
--jsonataQuery | Checks the response with a JSONata expression | A JSONata expression; it is used while --contentCheckMode jsonata |
The DNS Fields
| Field | What it does | What is written after it |
|---|---|---|
query | Determines the name to be queried | A domain name; it is required in the dns type |
--reverseDns | Queries a PTR record instead of an address | true · false (default false); when it is turned on, the record type is not asked for |
--rrType | Selects the record type to be queried | A (default) · AAAA · CAA · CNAME · MX · NAPTR · NS · PTR · SOA · SRV · TXT |
--dnsExpectType | Selects how the response will be checked | none (default) · text · regex |
dnsTextToExpect | Writes the text to be searched in the response | The expected text; when --dnsExpectType text is written it becomes required and is written without a prefix |
--dnsRegexToExpect | Writes the regular expression to be searched in the response | A regular expression; it opens while --dnsExpectType regex |
The FTP, LDAP, SMTP and Oracle Fields
| Field | What it does | What is written after it |
|---|---|---|
ftpUser · ftpPassword | Carries the credentials that will open the FTP session | The user name and the password; they are required in the ftp and ftps types |
--ftpAction | Selects how far the check will go | onlyLogin only opens a session (default) · loginAndList lists the directory as well |
--ftpPath | Listelenecek dizini belirler | Sunucudaki yol |
ldapUsername · ldapPassword | Carries the credentials that will connect to the directory | The user name and the password; they are required in the ldap and ldaps types. The password is asked for hidden |
--ldapAuth | Tries not only the connection but the authentication as well | true · false (default false) |
--smtpHelo | Determines the EHLO name to be sent to the server | A domain name; it is written in the smtp and smtps types |
--smtpStartTls | Turns on the encryption of the connection with STARTTLS | true · false (default false); it opens only in the smtp type |
oracleUser · oraclePassword | Carries the credentials that will connect to the database | The user name and the password; they are required in the oracle type |
oracleConnectionString | Carries the database connection information | The connection string; it is required in the oracle type |
The Scenario Steps
In the tcp, tcps, udp and oracle types the check consists of steps that run in order. Every step takes its own index; first what the step will do is selected, then the fields of that step are written.
tcp and tcps
| Field | What it does | What is written after it |
|---|---|---|
--tcpScenario.N.tcpAction | Selects what the step will do | sendText sends data · expectText expects text · expectRegex expects a regular expression · wait waits |
--tcpScenario.N.textToSend | Writes the data to be sent | Text; it opens while tcpAction sendText |
--tcpScenario.N.dataFormat | Selects the format of the sent data | text (default) · hex · base64; it opens while tcpAction sendText |
--tcpScenario.N.textToExpect | Writes the text to be searched in the response | The expected text; it opens while tcpAction expectText |
--tcpScenario.N.regexToExpect | Writes the regular expression to be searched in the response | A regular expression; it opens while tcpAction expectRegex |
--tcpScenario.N.tcpWaitMs | Determines how long the step will wait | Milliseconds; it opens while tcpAction wait |
udp
| Field | What it does | What is written after it |
|---|---|---|
--udpScenario.N.udpAction | Selects what the step will do | send sends data · wait waits · expectText expects text · expectRegex expects a regular expression |
--udpScenario.N.dataToSend | Writes the data to be sent | Data; it opens while udpAction send |
--udpScenario.N.dataFormat | Selects the format of the sent data | text (default) · hex · base64; it opens while udpAction send |
--udpScenario.N.textToExpect | Writes the text to be searched in the response | The expected text; it opens while udpAction expectText |
--udpScenario.N.regexToExpect | Writes the regular expression to be searched in the response | A regular expression; it opens while udpAction expectRegex |
--udpScenario.N.udpWaitMs | Determines how long the step will wait | Milliseconds; it opens while udpAction wait |
oracle
| Field | What it does | What is written after it |
|---|---|---|
--oracleScenario.N.oracleAction | Selects what the step will do | executeCmd runs a query · wait waits |
--oracleScenario.N.oracleCmd | Writes the query to be run | An SQL statement; it opens while oracleAction executeCmd |
--oracleScenario.N.oracleExpectedText | Writes the text to be searched in the result | The expected text; it opens while oracleAction executeCmd |
--oracleScenario.N.oracleExpectedMinRows | Determines at least how many rows the result has to return | The number of rows; it opens while oracleAction executeCmd |
--oracleScenario.N.oracleWaitMs | Determines how long the step will wait | Milliseconds; it opens while oracleAction wait |
Examples
admin@TR7LBWAF01> lb hc add checkType http name web-check \
--uri /saglik --method GET --expectedStatusCodes.0 200 \
--contentCheckMode basic --contentQuery "ok" --testInterval 5 --timeout 3
admin@TR7LBWAF01>
admin@TR7LBWAF01> lb hc add checkType https name tls-check \
--virtualDomain portal.kurum.com.tr --verifyCertificate true --tlsVerifyCa <ca>
# a two-step TCP scenario: send text, expect the response
admin@TR7LBWAF01> lb hc add checkType tcp name tcp-scenario \
--tcpScenario.0.tcpAction sendText --tcpScenario.0.textToSend "PING" \
--tcpScenario.1.tcpAction expectText --tcpScenario.1.textToExpect "PONG"
admin@TR7LBWAF01>
admin@TR7LBWAF01> lb hc add checkType dns name dns-check query portal.kurum.com.tr \
--rrType A --dnsExpectType text dnsTextToExpect 10.0.10.21
# the password is asked for hidden
admin@TR7LBWAF01> lb hc add checkType ldap name ldap-check ldapUsername cn=probe ldapPassword <password> --ldapAuth true
admin@TR7LBWAF01> lb backend update id <backend> --hc <check>
admin@TR7LBWAF01>
Updating and Deleting
admin@TR7LBWAF01> lb hc update id <id> --testInterval 10 --requiredFailure 3
# removing a scenario step · emptying the step list
admin@TR7LBWAF01> lb hc update id <id> --tcpScenario.1.delete
admin@TR7LBWAF01> lb hc update id <id> --tcpScenario.delete
admin@TR7LBWAF01> lb hc delete <id>
admin@TR7LBWAF01>
Bulk Update
update-many applies the same change to many health check records at once. The writing order is the same on every resource.
Step 1 Select the target
The only required field is
target: selected for the records selected from the list, all for the entire collection. Step 2 Add the fields to be written
Only the fields that can be written to many records with the same value are present; the fields specific to the record, such as the id, the name and the check type, do not take place in this command.
Step 3 Mark the targets from the list
When
target selected is written and no id is given, a selection list with checkboxes opens. Step 4 Confirm
A warning stating how many records will be affected appears; nothing is written until the confirmation word is typed.
| Field | Status | Value |
|---|---|---|
target | Required | selected — the records selected from the list · all — the whole collection |
--ids.N | Conditional | The target ids for target selected. It is not suggested in the Tab list: the targets are marked from the selection list. In a script and in a pipeline it is written manually. |
--onError | Optional | abort (default) — if even one of the targets does not pass the validation, nothing is written · skip — the targets that pass are written |
Writable Fields
# Tab after the command
admin@TR7LBWAF01> lb hc update-many
--info target
# Tab after the target field
admin@TR7LBWAF01> lb hc update-many target
all selected
# write -- and Tab: all the writable fields
admin@TR7LBWAF01> lb hc update-many target all --
--contentCheckMode --contentQuery --dnsExpectType
--dnsRegexToExpect --dnsTextToExpect --expectedStatusCodes.N
--ftpAction --ftpPassword --ftpPath
--ftpUser --httpBody --httpHeaders.N.name
--httpHeaders.N.value --httpVersion --info
--jsonataQuery --ldapAuth --method
--negate --onError --oracleConnectionString
--oraclePassword --oracleScenario.N.oracleAction --query
--requiredFailure --requiredSuccess --reverseDns
--rrType --smtpHelo --smtpStartTls
--tcpScenario.N.tcpAction --testInterval --timeout
--tlsClientCert --tlsVerifyCa --udpScenario.N.udpAction
--uri --verifyCertificate --virtualDomain
admin@TR7LBWAF01>
There are 39 fields in the command; the list above is the same as what appears when -- is written and Tab is pressed on the device. What each one does and what is written after it is in the table below.
The fields that are condition-bound in the single command (those that open according to the value of another field) are listed here without a condition: in the bulk update every target is validated separately according to its own record, and if the field is not active on a target it is skipped only on that target.
| Field | What it does | What is written after it |
|---|---|---|
--info | Writes what the command will do without running it | It does not take a value; it is written on its own |
--onError | Determines what will happen if a target does not pass the validation | abort writes nothing (default) · skip writes the targets that pass |
--testInterval | Determines at which interval the check will be repeated | Seconds (default 1) |
--timeout | Determines how long will be waited for the response | Seconds (default 1) |
--requiredSuccess | Determines the number of consecutive successes required to be counted as healthy | A number (default 3) |
--requiredFailure | Determines the number of consecutive failures required to be counted as unhealthy | A number (default 2) |
--negate | Reverses the result: a failure is counted as healthy | true · false (default false) |
--virtualDomain | Determines the name to be sent as Host and SNI in the connection | A domain name |
--verifyCertificate | Turns on the verification of the certificate of the server | true · false (default false) |
--tlsVerifyCa | Selects the CA profile to be used in the verification | The lb ca record; it is meaningful together with --verifyCertificate true |
--tlsClientCert | Selects the client certificate to be presented in the mutual verification | A certificate record |
--uri | Determines the path and the query to be requested in the HTTP check | A path, for example /saglik |
--method | Selects the HTTP request method | An HTTP method (default GET) |
--httpVersion | Selects the HTTP version to be used | 1.1 (default) · 2 |
--httpHeaders.N.name · --httpHeaders.N.value | Adds a header to the HTTP request | The header name and value; every pair with its own index |
--httpBody | Writes the HTTP request body | The body text to be sent |
--expectedStatusCodes.N | Determines the status codes to be counted as a success | A status code (default 200); more than one with its own index |
--contentCheckMode | Selects how the response body will be checked | basic text matching (default) · jsonata expression |
--contentQuery | Writes the text to be searched in the response | The expected text; it is used while --contentCheckMode basic |
--jsonataQuery | Checks the response with a JSONata expression | A JSONata expression; it is used while --contentCheckMode jsonata |
--query | Determines the name to be queried in the DNS check | A domain name |
--reverseDns | Queries a PTR record instead of an address | true · false (default false) |
--rrType | Selects the DNS record type to be queried | A (default) · AAAA · CAA · CNAME · MX · NAPTR · NS · PTR · SOA · SRV · TXT |
--dnsExpectType | Selects how the DNS response will be checked | none (default) · text · regex |
--dnsTextToExpect | Writes the text to be searched in the DNS response | The expected text; it is used while --dnsExpectType text |
--dnsRegexToExpect | Writes the regular expression to be searched in the DNS response | A regular expression; it is used while --dnsExpectType regex |
--ftpUser · --ftpPassword | Carries the credentials that will open the FTP session | The user name and the password |
--ftpAction | Selects how far the FTP check will go | onlyLogin only opens a session (default) · loginAndList lists the directory as well |
--ftpPath | Listelenecek dizini belirler | Sunucudaki yol |
--ldapAuth | In the directory tries not only the connection but the authentication as well | true · false (default false) |
--smtpHelo | Determines the EHLO name to be sent to the server | A domain name |
--smtpStartTls | Turns on the encryption of the connection with STARTTLS | true · false (default false) |
--oracleConnectionString | Carries the database connection information | The connection string |
--oraclePassword | Carries the password that will connect to the database | The password |
--tcpScenario.N.tcpAction | Selects what the step in the TCP scenario will do | sendText · expectText · expectRegex · wait |
--udpScenario.N.udpAction | Selects what the step in the UDP scenario will do | send · wait · expectText · expectRegex |
--oracleScenario.N.oracleAction | Selects what the step in the Oracle scenario will do | executeCmd · wait |
Fields that exist in the single command but not here, and the reasons:
| Field | Why it is not here |
|---|---|
checkType | The type of the check determines the identity of the record; it cannot be changed in bulk |
name | The name is unique; the same value cannot be written to many records |
ldapUsername | The directory user name is specific to the record |
ldapPassword | The password field is not written in bulk |
oracleUser | The database user name is specific to the record |
tcpScenario.N.textToSend | The content fields of the scenario steps depend on the step id |
udpScenario.N.dataToSend | In the same way it is specific to the step |
oracleScenario.N.oracleCmd | In the same way it is specific to the step |
Target Selection and Confirmation
admin@TR7LBWAF01> lb hc update-many target selected --testInterval 10
? Target objects
space: mark · ctrl+a: all · enter: confirm
Filter: (filter by typing) · esc: cancel
[x] <record-1>
[x] <record-2>
[ ] <record-3>
2 selected / 3
⚠ 2 objects will be updated
<record-1>, <record-2>
Type "yes" to confirm: yes
admin@TR7LBWAF01>
# the whole collection: the list does not open, the confirmation comes directly
admin@TR7LBWAF01> lb hc update-many target all --requiredFailure 3
⚠ This operation will update ALL the objects in the collection
Type "yes" to confirm:
# in a script or in a pipeline: the targets are written by hand, the list does not open
admin@TR7LBWAF01> lb hc update-many target selected \
--ids.0 <kimlik-1> --ids.1 <kimlik-2> --testInterval 10 --onError skip
admin@TR7LBWAF01>
The screen language depends on the user
The texts in the selection list and on the confirmation screen come according to the language preference of the signed-in user. The confirmation word is yes in the English interface and evet in the Turkish interface.
The detailed behavior of bulk update — which fields can be written in bulk and the report returned for each target — is on the API Commands page.
Things to Know
- A check does not work on its own. It starts when it is bound to a backend (
lb backend→--hc) or to a backend group. - The target address is not written in this command. The check uses the address of the backend to which it is bound; if a different address will be checked, the
--useDifferentIpand--differentIp.ipfields in the backend record are given. - The type determines the fields. After
checkTypeis selected, only the fields of that type are listed;--with Tab shows all of that type. - The passwords are asked for hidden. The password fields such as
ldapPasswordare asked for without appearing on the screen and are asked for again in an update. - The scenario steps run in order. The steps are executed according to the index order; when a step is removed from the middle, the following indexes shift.
