Administering Health Checks in ILB

ILB provides the following optional types of server health checks for the user to select from:

• Built-in ping probes

• Built-in TCP probes

• Built-in UDP probes

• User-supplied tests that can run as health checks

By default, ILB does not perform any health checks. You can specify health checks for each server group when creating a load-balancing rule. You can configure only one health check per load-balancing rule. As long as a virtual service is enabled, the health checks on the server group that is associated with the enabled virtual service start automatically and repeat periodically. The health checks stop as soon as the virtual service is disabled. The previous health check states are not preserved when the virtual service is re-enabled.

When you specify a TCP, UDP, or custom test probe for running a health check, ILB sends a ping probe, by default, to determine if the server is reachable before it sends the specified TCP, UDP, or custom test probe to the server. The ping probe is a method of monitoring server health. If the ping probe fails, the corresponding server is disabled with the health check status of unreachable. If the ping probe succeeds, but the TCP, UDP, or custom test probe fails, the server is disabled with the health check status of dead.

You can use the ilbadm command to create, delete, and list the health checks. For a list of definitions, see ILB Terminology.

Creating a Health Check

In the following example, two health checks objects,hc1 and hc-myscript, are created. The first health check uses the built-in TCP probe. The second health check uses a custom test, /var/tmp/my-script.

# ilbadm create-healthcheck \
-h hc-timeout=3,hc-count=2,hc-interval=8,hc-test=tcp hc1
# ilbadm create-healthcheck \ -h hc-timeout=3,hc-count=2,hc-interval=8,hc-test=/var/tmp/my-script hc-myscript

hc-test specifies the type of health check.

hc-interval specifies the interval between consecutive health checks. To avoid synchronization, the actual interval is randomized between 0.5 * hc-interval and 1.5 * hc-interval.

hc-timeout specifies the timeout when the health check considered to have failed if it does not complete.

hc-count specifies the number of attempts to run the hc-test health check.

User-Supplied Test Details

The following criteria must be met by the user-supplied test:

• The test can be a binary or a script.

• The test can reside anywhere on the system, and you must specify the absolute path when using the create-healthcheck subcommand.

  When you specify the test (for example, /var/tmp/my-script) as part of the health check specification in the create-rule subcommand, the ilbd daemon forks a process and executes the test, as follows:

  /var/tmp/my-script $1 $2 $3 $4 $5

  A description of the arguments is as follows:

  $1 VIP (literal IPv4 or IPv6 address)

  $2 Server IP (literal IPv4 or IPv6 address)

  $3 Protocol (UDP, TCP as a string)

  $4 Numeric port range (the user-specified value for hc-port)

  $5 maximum time (in seconds) that the test should wait before returning a failure. If the test runs beyond the specified time, it might be stopped, and the test would be considered failed. This value is user-defined and specified inhc-timeout.

The user-supplied test, my-script, might or might not use all the arguments, but it must return one of the following :

• Round Trip Time (RTT) in microseconds

• 0 if the test does not calculate RTT

• -1 for failure

By default, the health check test runs with the following privileges: PRIV_PROC_FORK, RIV_PROC_EXEC, RIV_NET_ICMPACCESS.

If a broader privilege set is required, you must implement setuid in the test. For more details on the privileges, refer to the privileges(5) man page.

Deleting a Health Check

The following example deletes a health check called hc1:

# ilbadm delete-healthcheck hc1

Listing Health Checks

You can use the list-healthcheck subcommand to obtain detailed information about configured health checks. The following example lists two configured health checks:

# ilbadm list-healthcheck

Displaying Health Check Results

You can use the list-hc-result subcommand to obtain health check results. If a rule or a health check is not specified, the subcommand lists all the health checks.

The following example displays the health check results associated with a rule called rule1:

# ilbadm show-hc-result rule1