Troubleshooting and Operations
Troubleshooting and Operations
This domain tests daily BIG-IP operations: backups, configuration sync, high availability, logging, packet capture, support bundles, and upgrades. Questions often ask what a tool proves, not just what it is called.
Core rules
- Backups: a UCS file contains the configuration and related files and is the standard full backup. An SCF is a text configuration export; XML is also text-based. Restore a UCS on a compatible software version, and remember that restore overwrites current configuration.
- High availability has separate concepts: config sync copies configuration between peers; failover moves active traffic. A device group and trust domain are prerequisites. Network failover and hardwired failover provide heartbeat paths. Syncing in the wrong direction can overwrite a good configuration.
- Logs live in /var/log/ltm, /var/log/apm, /var/log/asm, and /var/log/audit. Log levels control verbosity; remote syslog centralizes logs. Check the correct log before assuming a traffic problem.
- Packet capture: tcpdump on the client-facing or server-facing VLAN/interface shows whether packets arrive and return. Capture both sides when investigating SNAT or routing. ssldump helps with TLS handshakes; curl and ping test reachability.
- qkview collects diagnostics for iHealth and F5 Support. Run it before a reboot or failover if possible, because state is lost afterward. iHealth highlights known issues and configuration risks.
- Upgrades install to an inactive boot location. Take a UCS backup, verify licensing and disk space, install the image, boot the new location, then test and sync. Configuration sync should be verified after upgrade.
Worked example
Users intermittently get HTTP 503 from a virtual server. Reasoning: 503 from BIG-IP usually means no pool member is available. Check virtual-server status, pool member monitor status, and node status. If the monitor is HTTP with receive string 'OK' but the application returns a login page, the monitor marks the member down; fix the send/receive string or monitor path. If members are up, check SNAT and server-side routing; a server that cannot return traffic through BIG-IP causes failures. Check /var/log/ltm and capture traffic on both VLANs. Do not start by rebooting.
Traps
Treating config sync as failover; syncing from the wrong device; restoring a UCS over a newer configuration without a backup; capturing on the wrong VLAN; running qkview only after a reboot; assuming a node-down status and a pool-member-down status are the same; and ignoring monitor timeout versus application response time.