F5 Networks Exam 301b Topic 4 Question 67 Discussion

Actual exam question for F5 Networks's 301b exam

Question #: 67
Topic #: 4

[All 301b Questions]

An LTM Specialist is tasked with ensuring that the syslogs for the LTM device are sent to a remote syslog server.

The following is an extract from the config file detailing the node and monitor that the LTM device is using for the

remote syslog server:

monitor

Syslog_15002 {

defaults from udp

dest *:15002

}

node 91.223.45.231 {

monitor Syslog_15002

screen RemoteSYSLOG

}

There seem to be problems communicating with the remote syslog server. However, the pool monitor shows that the remote server is up.

The network department has confirmed that there are no firewall rules or networking issues preventing the LTM device from

communicating with the syslog server. The department responsible for the remote syslog server indicates that there may

be problems with the syslog server. The LTM Specialist checks the BIG-IP LTM logs for errors relating to the remote syslog

server. None are found. The LTM Specialist does a tcpdump:

tcpdump -nn port 15002, with the following results:

21:28:36.395543 IP 192.168.100.100.44772 > 91.223.45.231.15002: UDP, length 19

21:28:36.429073 IP 192.168.100.100.39499 > 91.223.45.231.15002: UDP, length 169

21:28:36.430714 IP 192.168.100.100.39499 > 91.223.45.231.15002: UDP, length 181

21:28:36.840524 IP 192.168.100.100.39499 > 91.223.45.231.15002: UDP, length 169

21:28:36.846547 IP 192.168.100.100.39499 > 91.223.45.231.15002: UDP, length 181

21:28:39.886343 IP 192.168.100.100.39499 > 91.223.45.231.15002: UDP, length 144

NotE. 192.168.100.100 is the self IP of the LTM device.

Why are there no errors for the remote syslog server in the log files?

AThe -log option for tcpdump needs to be used.

BThe monitor type used is inappropriate.

CThe 'verbose' logging option needs to be enabled for the pool.

DWhen the remote syslog sever fails, it returns to service before the timeout for the monitor has expired.

Show Suggested Answer

Suggested Answer: B

by Erick at Mar 20, 2023, 06:18 AM

Limited Time Offer

25%

Off

Get Premium 301b Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Melinda

1 months ago

Ooh, a tricky one! The tcpdump data looks good, so it's probably not a network problem. Maybe the remote syslog server is just having a bad day and dropping packets occasionally. Option D sounds like the most likely culprit. Gotta love those intermittent issues!

upvoted 0 times

Dominic

1 days ago

Intermittent issues can be a pain to troubleshoot, but at least we have a possible explanation now.

upvoted 0 times

...

Lamar

4 days ago

Yeah, that could explain why there are no errors in the log files.

upvoted 0 times

...

Goldie

10 days ago

Option D) When the remote syslog sever fails, it returns to service before the timeout for the monitor has expired.

upvoted 0 times

...

Joye

1 months ago

I'm going to go with Option D. If the remote syslog server is flaky and recovering before the monitor timeout, that would explain why the LTM logs don't show any errors. The tcpdump output suggests the traffic is flowing, so the issue must be on the server side.

upvoted 0 times

Eleni

10 days ago

That's a good point. The tcpdump output does show traffic flowing to the server.

upvoted 0 times

...

Buffy

16 days ago

I think Option D makes sense. The server might be recovering before the monitor timeout.

upvoted 0 times

...

Kerry

21 days ago

Exactly. In that case, the LTM logs wouldn't show errors because the server is back up before the timeout expires.

upvoted 0 times

...

Reta

22 days ago

It's possible that the server is failing intermittently, causing it to recover before the monitor timeout triggers.

upvoted 0 times

...

Glenn

23 days ago

That makes sense. The tcpdump output shows traffic flowing, so the server side could be the issue.

upvoted 0 times

...

Mica

1 months ago

Option D seems like a logical choice. The server might be recovering before the monitor timeout.

upvoted 0 times

...

Van

1 months ago

Haha, the LTM Specialist must be a real troubleshooting wizard to not find any errors in the logs. Maybe they should try turning it off and on again, that usually works! (Just kidding, but seriously, no errors in the logs is a bit suspicious.)

upvoted 0 times

...

Lucina

2 months ago

Option D sounds plausible. If the remote syslog server is briefly failing and then coming back up before the monitor timeout, the LTM would not see any errors in the logs. Might be worth checking the server's status more closely.

upvoted 0 times

Sonia

21 days ago

Might be worth checking the server's status more closely.

upvoted 0 times

...

Glen

1 months ago

Option D sounds plausible. If the remote syslog server is briefly failing and then coming back up before the monitor timeout, the LTM would not see any errors in the logs.

upvoted 0 times

...

Kris

2 months ago

Maybe enabling the 'verbose' logging option for the pool could help identify the issue.

upvoted 0 times

...

Nan

2 months ago

I agree with Glynda. The monitor type might not be suitable for the remote syslog server.

upvoted 0 times

...

Lindsay

2 months ago

The tcpdump output shows that the LTM device is sending UDP packets to the remote syslog server, so the issue doesn't seem to be with the network connectivity. The monitor is likely set up correctly, so the problem must be with the remote syslog server itself.

upvoted 0 times