Page 1 of 2

monitoring sites with SSL terminated on the LB

Posted: Tue Jul 30, 2013 3:07 pm
by decp
Hi,

I have a site that's currently SSL off-loaded to an F5 load balancer.

This simple HTTP only check from CLI works fine:
# check_http -s "string_to_check" -H http://www.foo.com -I 10.0.0.100 -u "/foo/content"

But this HTTPs gives "CRITICAL - Socket timeout after 10 seconds" error:
# check_http -s "string_to_check" -H http://www.foo.com -I 10.0.0.100 -u "/foo/content" -S -p 443

But if I terminate the SSL all the way to the web server, the above works.
Is there a special way to monitor SSL sites terminated on the load balancer?


Thanks for any info.

Re: monitoring sites with SSL terminated on the LB

Posted: Tue Jul 30, 2013 3:18 pm
by decp
btw, i'm using nagios xi.
but this works on nagios core 2.9

Re: monitoring sites with SSL terminated on the LB

Posted: Tue Jul 30, 2013 3:29 pm
by abrist
decp wrote:check_http -s "string_to_check" -H http://www.foo.com -I 10.0.0.100 -u "/foo/content" -S -p 443
Are you sure the web address is still http instead of https?

Code: Select all

check_http -s "string_to_check" -H https://www.foo.com -I 10.0.0.100 -u "/foo/content" -S -p 443

Re: monitoring sites with SSL terminated on the LB

Posted: Tue Jul 30, 2013 3:35 pm
by decp
i tried that:
check_http -s "string_to_check" -H https://www.foo.com -I 10.0.0.100 -u "/foo/content" -S -p 443

and
check_http -s "string_to_check" -H http://www.foo.com -I 10.0.0.100 -u "/foo/content" -S -p 443
check_http -s "string_to_check" www.foo.com -I 10.0.0.100 -u "/foo/content" -S -p 443

still getting that same error.

Re: monitoring sites with SSL terminated on the LB

Posted: Tue Jul 30, 2013 3:36 pm
by decp
abrist wrote: Are you sure the web address is still http instead of https?

Code: Select all

check_http -s "string_to_check" -H https://www.foo.com -I 10.0.0.100 -u "/foo/content" -S -p 443
the site responds to both http and https if that's what you're asking?

Re: monitoring sites with SSL terminated on the LB

Posted: Tue Jul 30, 2013 8:33 pm
by scottwilkerson
can you run it like this

Code: Select all

check_http -s "string_to_check" -H www.foo.com -u "/foo/content" -S -p 443

Re: monitoring sites with SSL terminated on the LB

Posted: Wed Jul 31, 2013 4:03 pm
by decp
scottwilkerson wrote:can you run it like this

Code: Select all

check_http -s "string_to_check" -H www.foo.com -u "/foo/content" -S -p 443

same error - CRITICAL - Socket timeout after 10 seconds
but it works fine on nagios core 2.9, weird.

Re: monitoring sites with SSL terminated on the LB

Posted: Wed Jul 31, 2013 4:23 pm
by abrist
Is this website protected by any type of auth (even basic)?

Re: monitoring sites with SSL terminated on the LB

Posted: Wed Jul 31, 2013 4:28 pm
by decp
abrist wrote:Is this website protected by any type of auth (even basic)?
No.
Is there a log somewhere that I can check? or some debug level I can turn on?

Re: monitoring sites with SSL terminated on the LB

Posted: Wed Jul 31, 2013 4:31 pm
by abrist
You can check the ssl_access_log and ssl_error_log.

Code: Select all

tail -25 /var/log/httpd/ssl_access_log
tail -25 /var/log/httpd/ssl_error_log