Re: F5 LTM hitting SSL TPS license limit

Quoting "Rosenberry, Eric" <[email protected]>:

> FYI-
>
> I ran into this issue with my F5 LTM's recently and I wanted to  
> share it with the rest of the world in such a form that future  
> Google searches would pick it up since I could not find any  
> information on it myself.
>
> If you are getting a message similar to this in your LTM logs and  
> you don't think you are anywhere near your licensed SSL TPS limit,  
> you might be running into this issue:
> tmm tmm[1253]: 01260008:3: SSL transaction (TPS) rate limit reached
>
> After many hours of working with F5 support and analyzing packet  
> dumps to prove the issue to F5 it would appear that the F5 tracks  
> your SSL TPS license limit on some sub-second interval.  i.e. if you  
> have a 2000TPS license it seems to chop this up into smaller windows  
> (say 1/10th of a second for this example) and enforce the limit of  
> 200 TPS on each 1/10th of a second bucket.
>

FWIW this has been a known problem on the F5 LTM's for a long long  
time. I originally struck it several years ago, and also raised an  
issue. I've also discussed it offline with several people at F5, and  
compared it with the actions they take when you exceed the compression  
license.

With compression, you simply lose the compressing. Site still works.  
When you exceed the SSL limit you lose the site because the  
connections are simply binned.

I did suggest at the time a couple of alternative possibilities

1. As people do offload for hardware compression simply drop back to  
software compression. Result - CPU gets thrashed, and the site may  
slow up, but at least it's obvious you have an issue, and you can then  
take action. And bursts wouldn't be noticed except maybe for a log  
message)

2. Have a grace period. Sure, sample at 10Hz or whatever. But let the  
site burst over the licensed limit for 20% of the 10Hz 'slots' over a  
60 second period.

I'm not sure they'll ever get actioned however. As apparently the new  
hardware is licensed differently. It was suggested to me that the new  
way of doing it is with a 500TPS license by default, and a single  
'unlimited' license that will let you run without checking, as fast as  
the hardware & software of the F5 will let you.

I did also remark that there's no way to know what the F5 things the  
current SSL TPS is... I have issues that of it's going to measure at  
say 10Hz and then apply hard limits, you should be able to find out  
what the rates have been... Apart from working it out by polling  
extreemly fast with SNMP however there's no way to doit. And if you do  
poll at that rate, you'll more than likely trash the box with snmpd  
taking all the CPU anyway. (And don't even think about trying to run  
iControl to gather stats at that rate).



H

----------------------------------------------------------------
This message was sent using IMP, the Internet Messaging Program.
_______________________________________________
lb-l mailing list
[email protected]
http://vegan.net/mailman/listinfo/lb-l
Searchable Archive: http://vegan.net/lb/archive
http://lbdigest.com Load Balancing Digest
http://lbwiki.com Load Balancing Wiki