F5CAB5 BIG-IP Administration Support and Troubleshooting (F5CAB5) exam Questions and Answers

The BIG-IP system uses the audit log to track administrative actions and configuration changes.

Audit Logging Functionality: When a user modifies the configuration via the Configuration Utility (GUI), the Traffic Management Shell (tmsh), or iControl, the system records the event in the audit log. This includes the name of the user who made the change, the timestamp, and the specific command or object that was modified.

Log Location: The audit log is stored at /var/log/audit.

Evaluation of Other Options:

/var/log/messages (Option A) contains general system and kernel messages but is not the primary source for configuration change details.

/var/log/secure (Option B) primarily logs authentication and authorization attempts (logins and logouts).

/var/log/user.log (Option D) is a generic Linux log file for user-level applications and does not track BIG-IP LTM configuration changes.

According toofficial F5 documentation (K52015891 – Troubleshooting BIG-IP power supply issues),hardware-related alerts for power supplies, fans, and chassis components are logged in /var/log/ltm.

When a BIG-IP device experiences a power supply issue—such as failure, intermittent outages, or fan-related faults—the system generates alerts through internal platform monitoring services. These alerts are written to the/var/log/ltmfile and often appear with messages similar to:

Chassis power supply 2 has experienced an issue. Status is as follows: FAN=bad; STATUS=bad.

This makes /var/log/ltm theauthoritative log filefor identifying and verifying power supply and chassis-related problems on BIG-IP systems.

The other log files are not appropriate for this purpose:

/var/log/daemon.logcontains general daemon messages but isnot the primary sourcefor chassis hardware alerts.

/var/log/kern.loglogs kernel-level events, not platform power status.

/var/log/auditrecords administrative actions and configuration changes.

Conclusion:

Per F5-supported guidance, when suspecting power supply outages or chassis hardware issues, the BIG-IP Administrator shouldalways check /var/log/ltm first.

The exhibit shows the virtual serverapplication_vswith a status indicating it isoffline but enabled. In BIG-IP terminology, this status means the virtual server itself is administratively enabled, but it is unable to pass traffic becauseno usable pool members are available.

Two common and documented causes for this condition are:

Pool member(s) administratively disabled (Option A):When all pool members are administratively disabled, BIG-IP removes them from load-balancing decisions. Even though the virtual server remains enabled, it has no available pool members to send traffic to, resulting in an offline status.

Node(s) administratively disabled (Option C):Pool members inherit the status of their parent nodes. If a node is administratively disabled, all associated pool members are also marked unavailable. This condition causes the virtual server to show as offline, even though the virtual server configuration itself is correct.

The other options are incorrect:

Forced offline pool members (Option B)result in a different operational intent and are explicitly set for maintenance scenarios.

Virtual server administratively disabled (Option D)would show the virtual server as disabled, not enabled/offline.

This behavior is consistent with BIG-IP traffic management logic and is commonly verified by reviewingpool and node availability stateswhen diagnosing virtual server availability issues.

F5 recommends using the iHealth diagnostic tool to identify security vulnerabilities and receive specific remediation guidance.

QKView and iHealth: A QKView file is a comprehensive diagnostic snapshot of the BIG-IP system. When this file is uploaded to the F5 iHealth portal, it is automatically parsed against a database of known issues and security advisories.

Vulnerability Diagnosis: The iHealth platform includes automated checks specifically designed to surface security gaps and "Heuristics" that match the system's current configuration and software version to known CVEs (Common Vulnerabilities and Exposures).

Remediation Guidance: For every identified vulnerability, iHealth provides direct links to the relevant F5 Security Advisory (K-article), which contains detailed remediation steps, such as specific software versions that contain a fix or temporary mitigation commands.

UCS vs. QKView: While a UCS (User Configuration Set) file is a backup of the system configuration, it is not the format used by the iHealth diagnostic engine for automated vulnerability scanning; the QKView is the required format for this process.

Comprehensive and Detailed 150 to 250 Words Explanation From BIG-IP Administration, Support, and Troubleshooting Documents:

These log messages indicate that the BIG-IP system’sTraffic Management Microkernel (TMM)has enteredaggressive eviction modedue tohigh global memory utilization. When TMM memory consumption reaches critical thresholds, BIG-IP activates thedefault eviction policyto protect system stability and prevent a full traffic processing failure. This condition directly corresponds toOption A, where the global eviction policy is triggered because TMM memory resources are nearing exhaustion.

Once aggressive mode is activated, BIG-IP begins using theconnection sweeper mechanism, which selectively terminates existing connections to free memory. The repeated log entries stating“1 connections killed”confirm that the system isreaping some connections, not all connections. This behavior matchesOption C. The eviction process is incremental and controlled, targeting idle, low-priority, or least-recently-used connections first to minimize impact on active traffic.

Option B is incorrect because BIG-IP doesnotdrop all connections during aggressive mode; it only removes enough connections to relieve memory pressure. Option D is also incorrect because TMM eviction is based onTMM global memory usage, not swap memory utilization. TMM does not rely on swap space in the same way the host Linux system does.

These messages are a critical warning sign that the system is under memory stress and may require traffic optimization, connection limits, or hardware scaling.

Monitoring granular resource utilization is essential when troubleshooting performance degradation for specific applications. While global system stats show overall hardware health, they do not pinpoint which virtual server is overconsuming resources during traffic spikes. To identify the specific application causing a high CPU load, the administrator should navigate to Statistics > Module Statistics > Local Traffic > Virtual Servers7474. This section provides detailed metrics for each virtual server, including CPU cycles used for traffic processing and iRule execution75. Identifying a "top-talker" or a problematic virtual server allows the administrator to take targeted action, such as optimizing an inefficient iRule, adjusting compression levels, or offloading the virtual server to a different device group76. This targeted troubleshooting ensures that one high-demand virtual server does not negatively impact the performance of other services running on the same BIG-IP hardware, maintaining overall system stability and resource availability

Comprehensive and Detailed 150 to 250 Words Explanation From BIG-IP Administration, Support, and Troubleshooting Documents:

AQKViewfile is the primary diagnostic support bundle used by F5 Support to troubleshoot BIG-IP system issues. It contains comprehensive system information, including running configuration, licensing details, module provisioning, hardware status, software versions, log files, statistics, and the output of numerous diagnostic commands. Generating a QKView is a standard and recommended first step when investigating performance problems, configuration issues, or when opening a support case with F5.

In the BIG-IP Configuration Utility (GUI), the correct and supported location to generate a QKView isSystem > Support. This menu is specifically designed for support and troubleshooting operations. From this section, administrators can generate a QKView file, monitor its creation progress, download it locally, or upload it directly to F5 iHealth for automated analysis. This workflow is clearly documented in BIG-IP Administration and Support guides and aligns with F5 best practices.

The other menu options are not appropriate:

System > Configurationis used for system-wide settings such as DNS, NTP, and device identity.

System > Archiveis used to create UCS backup files, which are configuration backups, not diagnostic bundles.

System > Logsis used only for viewing system logs, not generating support files.

Therefore,System > Supportis the correct and only valid answer.

On a BIG-IP system, hardware-related alerts, including those for power supply units (PSUs), fans, and chassis components, are primarily logged in the Local Traffic Manager (LTM) log file.

Log Location: The file path is /var/log/ltm.

PSU Alert Messages: When a power supply fails, experiences an outage, or is unplugged, the chmand (Chassis Manager) or system_check processes log specific error codes to this file. For example, you may see messages like 010d0006:0: Chassis power supply has experienced an issue or VINPUT=bad.

Troubleshooting: Administrators can use the command grep -i "power supply" /var/log/ltm to quickly filter for PSU-related events.

Other Logs: * /var/log/kern.log typically contains low-level kernel and driver messages.

/var/log/audit tracks administrative changes and commands executed by users.

/var/log/daemon.log contains messages from various system background services but is not the primary location for hardware sensor alerts.

A gateway_icmp monitor checks basic network reachability by sending ICMP echo requests (pings) to the pool member or its gateway. If the pool is markedDOWNwhile the server is confirmed to be online, the most likely cause is thatICMP traffic is being blocked.

Ahost-based firewall active on the server (Option C)can block ICMP echo requests or replies, preventing BIG-IP from receiving a successful response to the health check. This results in the monitor failing and the pool member being marked down, even though the server and application are otherwise functioning normally. This explanation is consistent with the scenario where other servers in the same subnet work correctly, indicating that routing and BIG-IP configuration are not the issue.

The other options are unrelated to ICMP monitoring. Logged-in users (Option A), missing patches (Option B), and stopped HTTP services (Option D) do not affect a gateway_icmp monitor. BIG-IP troubleshooting best practices recommend verifying ICMP reachability and firewall policies when diagnosing ICMP-based monitor failures.

The pool member is markedDOWNbecause it is monitored bymultiple health monitors, specifically anHTTPmonitor and anHTTP/2monitor. The status message clearly shows that theHTTP monitor is UP, while theHTTP/2 monitor is DOWN. In BIG-IP, when multiple monitors are assigned to a pool member, the default behavior isAND logic, meaningall assigned monitors must succeedfor the pool member to be considered healthy.

In this scenario, the server is responding successfully to standard HTTP (likely HTTP/1.1) requests but does not support or respond correctly to HTTP/2 requests. As a result, the HTTP/2 monitor fails, which causes the overall monitor status to beDOWN, even though HTTP traffic itself is working.

This behavior is expected and documented in BIG-IP monitoring logic. Unless the monitor rule is explicitly changed to“at least one of”, a single failing monitor will mark the pool member down. Therefore, the correct conclusion is that the pool member isonly serving HTTP traffic, not HTTP/2.

The resolution would be to either remove the HTTP/2 monitor, correct the application to support HTTP/2, or adjust the monitor rule to match the intended health-check logic.

The End User Diagnostics (EUD) utility is a hardware-level testing suite used to verify the integrity of the physical components of a BIG-IP appliance.

Access Requirements: Because the EUD must be run while the TMOS operating system is not loaded (typically when the device cannot boot or requires hardware validation), it cannot be accessed via network-based interfaces like the Management Port or VLANs.

Console Connection: The administrator must connect a terminal to the physical Console Port (using a serial cable) to interact with the boot menu.

Execution Process: Upon restarting the appliance, the administrator must intercept the boot process at the GRUB menu and select the "End User Diagnostics" option. All output and menu selections are then handled through the serial console session.

In the BIG-IP Configuration Utility, the status icon (shape and color) provides immediate feedback on why a virtual server is not working as expected81. A "Red Diamond" indicates that the object is "Offline" and unavailable to process traffic82. For a virtual server, this specific status typically means it has inherited an offline state from its mandatory backend resources8383. If all pool members associated with the virtual server have failed their health monitors, the virtual server will transition to a red diamond status because it has no healthy destination for incoming requests. This is distinct from a "Black Circle," which would indicate the virtual server has been manually "Disabled" by an administrator85858585. To troubleshoot a red diamond, the administrator must examine the associated pool and its members to determine why the health monitors are failing (e.g., server crashes, network path failures, or incorrect monitor strings). Resolving the health check failures on the pool members will return the virtual server to an "Available" (Green) status.

To gather granular Layer 7 data such as specific HTTP methods (GET, POST, etc.) and HTTP status codes (200, 404, 500), the BIG-IP system utilizes the Analytics (AVR) profile.

Analytics Profile (Application Visibility and Reporting): While a standard HTTP profile tracks basic byte counts and requests, the Analytics profile is designed specifically to capture, analyze, and display detailed application performance metrics.

Metrics Captured: When attached to a virtual server, it records URL-level statistics, response codes, page load times, and client-side metrics.

Why not others? * HTTP Profile (Option A): This profile handles the parsing of HTTP traffic but does not provide a built-in reporting dashboard for status code distribution.

Statistics Profile (Option C): This is a legacy profile used for custom user-defined counters and does not automatically categorize HTTP methods or status codes.

Request Adapt (Option D): This is used for integrating with ICAP servers (like virus scanners) and does not perform traffic reporting.

In F5 TMOS administration, the traffic flow is processed through specific event huddles w3ithin iRules. To troubleshoot or m4odify traffic based on a URI (Uniform Resource Identifier), the BIG-IP system must first parse the application-layer data. The HTTP_REQUEST event is triggered when the system has fully received and parsed the HTTP request headers from the client5. This is the correct point to implement logic that selects a pool or pool member based on the path or file requested (e.g., /images or /api). Using CLIENT_ACCEPTED would be too early in the troubleshooting process because that event triggers at the L4 (TCP) connection establishment phase, before any URI information is available6. Conversely, HTTP_RESPONSE occurs during the return traffic from the server, which is too late to make a load balancing decision7. For troubleshooting virtual server behavior where URIs are involved, ensuring the iRule is attached to a Virtual Server with an HTTP profile and using the HTTP_REQUEST event is essential for proper traffic steering and inspection.

Troubleshooting SSL connection resets often involves verifying license limits against actual resource utilization. F5 devices use a "Transactions Per Second" (TPS) license to control the amount of SSL processing the device can handle. The log entry SSL transaction (TPS) rate limit reached is a clear indicator that the traffic volume has exceeded the licensed capacity. When determining the necessary license level, it is important to know that F5 primarily licenses and limits the "Client-side" SSL TPS—which represents the encrypted connections between the users and the virtual servers. In this specific scenario, the peak demand reached 1200 client-side transactions per second. Although there were also 800 server-side transactions (re-encryption from the BIG-IP to the pool), these typically do not count against the primary TPS license limit in the same manner. Therefore, to ensure that the virtual server works as expected during peak load, the administrator must upgrade the license to at least 1200 TPS. This troubleshooting process links system log errors to license-enforced resource constraints.

When a virtual server is not working as expected despite the pool members being marked "UP" (Green), the issue is frequently a return-path routing failure. If the BIG-IP forwards a request with the original client's source IP address, the backend server will try to respond directly to that client. If the server does not have its default gateway pointed back to the BIG-IP, the response packet will be routed elsewhere (or dropped), resulting in a connection timeout for the user. To resolve this, the administrator must configure "Source Address Translation" (SNAT). By setting SNAT to "Automap" or a specific SNAT address, the BIG-IP replaces the client's IP with its own internal self-IP. The backend server then sees the BIG-IP as the source and sends the response back to it locally. This troubleshooting step ensures a functional, symmetric tr18affic flow. Identifying the need for SNAT is one of the most common troubleshooting tasks for new virtual server deployments where the BIG-IP is not the default gateway for the backend servers.