Home > F5 BigIP > Load balancing of GrayLog (GELF) on F5 BigIP

Load balancing of GrayLog (GELF) on F5 BigIP

I have just had to configure load balancing of GrayLog that works as per this spec.

Long story short, this should be done with standard UDP VS and universal persistence profile based on the iRule as follows:

when CLIENT_ACCEPTED {
if {[UDP::payload length] >= 12 } {
#binary scan [UDP::payload 12] H* chunkedheader
binary scan [UDP::payload 12] H4H16c1c1 magicbytes messageid seqno seqcount
#incr seqno
if { $magicbytes equals “1e0f”} {
#log local0. “GrayLog chunked message received. Header: $chunkedheader; ID: $messageid (msg #$seqno of $seqcount)”
persist uie $messageid
}
}
}

(remove the #’s for logging – debugging works very nicely when LTM logs are cross-referenced with relevant captures done by tcpdump/wireshark)

I recommend changing timeout on the persistence profile to make life easier for the load balancer – in our environment we’re getting loads of messages so there is a risk of making persistence table very big very quickly. I set mine to 5 secs though technically speaking this timeout is different from 5 secs outlined in the GELF specification.

Pay attention to the fact that the event that needs to be referenced in the iRule is CLIENT_ACCEPTED. The rule is not going to work with CLIENT_DATA due to version specific behaviour rightly outlined here. I missed that in first place which puzzled me for a day until I was helped on DevCentral. (fantastic resource by the way!)

Advertisements
Categories: F5 BigIP Tags:
  1. No comments yet.
  1. No trackbacks yet.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

%d bloggers like this: