T Techclick ← F5 hub
F5 BIG-IP · LTM · Command ladder

F5 BIG-IP command ladder — six checks, one show each

02:10. The portal is “down.” You do not fail over. You walk six official tmsh show commands in order — unit, virtual, pool, persist, connection, log — and you stop at the first rung that fails. Colour is not evidence. The Reason line is.

18 min read · L2 primary · Quiz at end · Official tmsh show only

After this page you can

Quick answer

Start on the active unit with show sys ha-status. Then show ltm virtual (Reason, not colour), show ltm pool (member Reason), show ltm persistence persist-records (pin), show sys connection (cs/ss quadruple + SNAT source), show sys log ltm (01010201, 01070638). Delete persist, failover, and modify are change-control. Every rung on this page is a show.

Say this out loud

I name the layer before I name the fix. A green pool is a monitor result, not a user result. I do not type a write until I can point at a show that justifies it.

1. Why the ladder exists

Night shift inherits INC-4412: “payments VIP is down.” Someone already typed “please failover.” The dashboard is green on one screen and red on another. If you start at persist, or at the pool, or at a reboot, you will prove things that were never broken and destroy the evidence that was.

A request crossing BIG-IP LTM is one transaction. The ticket is one question: where did this transaction stop? The ladder converts that question into six official show reads. Walk them in order. Stop at the first rung you cannot clear.

Hero · night desk
Night operations desk with a six-rung command ladder on the monitor
You prove the layer before you change the pair. Training reconstruction — confirm tmsh on the software train you are about to touch.
Official show only

The six rungs are F5 TMSH show commands from the published reference: sys ha-status, ltm virtual, ltm pool, ltm persistence persist-records, sys connection, sys log ltm. tcpdump, curl, and openssl are useful later. They are not on this ladder. Confirm current syntax on your TMOS train before you type on a customer pair.

2. Six checks, one show command

Pre-train the six words before you open tmsh. Unit is which box owns the traffic-group. Virtual is the listener (destination, port, VLAN, profiles, SNAT stanza) — not the application. Pool is what monitors claimed about members. Persist is a pin that can outlive a monitor. Connection is the live TMM quadruple. Log is what LTM already wrote, including faults that never turn a pool red.

Model · six rungs
Six abstract rungs of a troubleshooting ladder
One idea per rung. Skip a rung and you spend an hour proving the wrong layer.

Isolate (show)

ha-status · virtual · pool · persist-records · connection · log ltm. These decide the sentence you paste in the ticket.

Change-control (write)

delete persist-records · run sys failover · modify a monitor or SNAT · save / config-sync. Name the show that justifies the write.

RungCheckOfficial commandYou are looking for
1Right unit?tmsh show sys ha-statusThis box is active for the traffic-group. Standby tables are empty and honest.
2Listener available, why?tmsh show ltm virtual vs_payments_443Availability, State, Reason, Destination. Colour is decoration.
3What did monitors mark?tmsh show ltm pool pool_paymentsPer-member Availability and the monitor Reason string.
4Is a pin holding users?tmsh show ltm persistence persist-recordsvirtual / client-addr / node-addr still on a down member.
5Did serverside open?tmsh show sys connectioncs-client · cs-server · ss-client · ss-server. ss-client is the SNAT source.
6What did LTM already log?tmsh show sys log ltm01070638 down, 01070727 up, 01010201 port exhaustion, 01260013 noise.

Sibling of rung 1: tmsh show sys failover prints the failover state (active / standby / offline) and how long the unit has been there. Use it when you only need the one word. Use ha-status when you need the feature table that explains why a unit would leave active.

3. The command ladder

Flowchart first. Do not start at persist-records. Do not start at failover. The order is the skill.

Flow 1 · six-rung isolate ladder
Isolate ladder — official tmsh show only 1 ha-status active unit? 2 virtual Reason line 3 pool member Reason 4 persist pin to node? 5 conn cs / ss quad 6 log message ID Fork — Reason names the pool After rung 2, if Reason is “The children pool member(s) are down” show ltm pool pool_payments show ltm persistence persist-records The virtual is enabled. It inherited offline from the pool. Take the VIP off your list. Read member Reason. Source: TMSH show ltm virtual / pool Fork — VIP available, users fail After rung 2, if Reason is “The virtual server is available” show sys connection cs-server-addr … show sys log ltm Green listener is the start of the sentence. Look for empty ss half, ss-client = client IP, or 01010201. Source: K40033505 · K8246

Read left → right. Same six commands. Different fork after the Reason line. Diamond in prose: if children-down then pool; if available then connection + log.

4. Which command, which ticket

One table. Match the symptom to the rung. If two rungs could apply, keep the order — never skip unit, never skip Reason.

You saw / they saidType this showIf it provesNext is
You just SSH’d to a pairshow sys ha-statusStandby, or a feature already failingIsolate — move to active
“VIP is down”show ltm virtual vs_payments_443Reason: children pool member(s) are downIsolate — show the pool
VIP Reason names the poolshow ltm pool pool_paymentsMember Reason: Unable to connect / monitor downIsolate — persist-records
Half of finance blank after lunchshow ltm persistence persist-records virtual vs_payments_443client-addr still on the down node-addrChange-control to delete, or wait TTL
VIP available, pool available, users failshow sys connection cs-server-addr 10.10.10.50No row, or ss-client still the client IPIsolate — SNAT none / return path
Fails only at peak, dashboard greenshow sys log ltm01010201 Inet port exhaustionChange-control — SNAT pool, not more members
Both units claim Activeshow sys ha-status on eachFailover path / heartbeat failedIsolate the path, then change-control
You already wrote a fixshow cm sync-statusIn Sync vs Changes Pending vs DisconnectedChange-control — config-sync if you meant to persist it
Choose · client to return
Client to listener to pool to return path as four glass panels
Client → listener (rung 2) → pool (rung 3) → return (rung 5). Persist (rung 4) sits on the pin. Log (rung 6) sits under all of them.

5. Walk the six rungs

Training reconstruction. Object names are lab examples in /Common. Output field names match the published TMSH / K-article shapes. Confirm live syntax on the train you are about to touch.

Side A — open the ticket (rungs 1–2)

  1. Rung 1 · tmsh show sys ha-status

    Source: F5 TMSH Reference, sys ha-status. Displays HA status of a unit in a redundant pair. If this unit is not active for the traffic-group that owns the VIP, every later table will be empty and you will invent a fault.

    tmos · training reconstruction
    show sys ha-status
Sys::HA Status
Current   active
# sibling, one word only:
show sys failover
Status    active

  2. Rung 2 · tmsh show ltm virtual vs_payments_443

    Source: F5 TMSH show command against ltm virtual. Read three lines: Availability, State, Reason. Enabled + offline + “children pool member(s) are down” means the listener is configured and inherited pool state. Enabled + available on a VIP users cannot reach means the break is off this object — go to rungs 5 and 6.

    tmos · training reconstruction
    show ltm virtual vs_payments_443
Ltm::Virtual Server: /Common/vs_payments_443
  Status
    Availability     : offline
    State            : enabled
    Reason           : The children pool member(s) are down
  Destination        : 10.10.10.50:443
Do not rebuild the virtual

Reason named the pool. The virtual is now off your list. Rebuilding destination, profiles, or SNAT here is how you create the second incident.

Side B — pool truth and the pin (rungs 3–4)

  1. Rung 3 · tmsh show ltm pool pool_payments

    Source: F5 TMSH Reference, ltm pool DISPLAY — show pool [name] prints statistics and status, including members. A member Availability of offline is a monitor claim, not a fact about the application. Read the member Reason. Then decide whether persist can still be sending users there.

    tmos · training reconstruction
    show ltm pool pool_payments
Ltm::Pool: /Common/pool_payments
  Status
    Availability : offline
    Reason       : The children pool member(s) are down
Ltm::Pool Member: 10.20.30.11:443
    Availability : available    Reason : Pool member is available
Ltm::Pool Member: 10.20.30.12:443
    Availability : offline      Reason : /Common/https: Unable to connect

  2. Rung 4 · tmsh show ltm persistence persist-records

    Source: F5 TMSH Reference, ltm persistence persist-records. Official filters: virtual, pool, client-addr, node-addr, mode. A record on 10.20.30.12 after that member is monitor-down is the classic “VIP green-ish, half of finance blank” ticket. delete persist-records is a write. Paste the show line first.

    tmos · training reconstruction
    show ltm persistence persist-records virtual vs_payments_443
Sys::Persist
virtual             mode          value        node              age
vs_payments_443     source-addr   10.10.8.22   10.20.30.12:443   184

Side C — live flows and the log the box already wrote (rungs 5–6)

  1. Rung 5 · tmsh show sys connection

    Source: F5 K40033505. show sys connection displays data-plane connections TMM is handling. The printed quadruple is cs-client, cs-server (VIP), ss-client (SNAT or original client), ss-server (member). Filter with cs-server-addr, cs-client-addr, ss-server-addr. If ss-client equals the client IP, SNAT did not translate. If there is no row while users retry, TMM never built the flow.

    tmos · training reconstruction
    show sys connection cs-server-addr 10.10.10.50
Sys::Connections
10.10.8.22:51221  10.10.10.50:443  10.20.30.5:41200  10.20.30.11:443  tcp  12  (tmm: 0)
# ss-client 10.20.30.5 = automap / SNAT source the member sees

  2. Rung 6 · tmsh show sys log ltm

    Source: F5 TMSH Reference, sys log — show log ltm displays Local Traffic Manager logs. This is the tmsh path when you do not drop to bash. 01070638 / 01070727 pair the monitor down/up window. 01010201 is Inet port exhaustion — pool stays available while new serverside ports run out (K8246, K33355231). 01260013 SSL handshake failed is documented as informational (K11058264) — not a root cause by itself.

    tmos · training reconstruction
    show sys log ltm
01070638:3: Pool /Common/pool_payments member 10.20.30.12:443 monitor status down.
01010201:2: Inet port exhaustion on 10.20.30.5 to 10.20.30.11:443 (proto 6)
01260013:3: SSL Handshake failed for TCP 10.10.8.40:443
Closeout show, not a conclusion

After a write, re-run the same show that named the fault. Then tmsh show cm sync-status. In Sync means the peer will not reintroduce the old config on the next failover. save / config-sync are writes — they are not rungs on the isolate ladder.

6. Runtime path after go-live

Once the VIP is in production, the same six shows map onto the live transaction. Use this when the app team asks “is it F5?” and you have sixty seconds.

Proof · ticket closeout
Operations desk with health checkmarks after a closed ticket
A closed ticket is a pasted show block plus In Sync — not a green screenshot.
Flow 2 · one transaction, six shows
Runtime — where each show sits on the wire Client 10.10.8.22 Virtual 10.10.10.50:443 TMM flow cs + ss quad Member 10.20.30.11:443 Reply through BIG-IP Map the show to the hop Unit owns the hop — show sys ha-status. Listener exists — show ltm virtual. Member health — show ltm pool. Pin — show ltm persistence persist-records. Quadruple — show sys connection. Hidden fault — show sys log ltm. If ss-client still equals 10.10.8.22, SNAT did not fire and the reply can leave via the server’s own gateway. Every object on the device can still report available. That is why return path is a separate rung, not an assumption.

Read left → right. If the reply never recrosses the pair, rungs 2 and 3 stay green. Rung 5 names it.

7. Traps + proof checklist

TrapWhat it looks likeProof from a show
Started on standbyEmpty persist, empty connection, “nothing is wrong”show sys ha-status / show sys failover — not active
Trusted the colourPool available, users failingshow sys log ltm → 01010201, or show sys connection → ss-client = client IP
Rebuilt a healthy virtualReason already said children are downshow ltm virtual State enabled + Reason names the pool
Ignored the pinOne member down, half the users still thereshow ltm persistence persist-records node-addr = down member
Deleted persist on the bridgeWrite with no pasted readShow first. Delete is change-control (TMSH persist-records DELETE)
Treated 01260013 as root causeSSL handshake failed, ticket closedK11058264 — informational. Need another show (profile / connection / log pair)
Fixed it, skipped syncFault returns on the next failovershow cm sync-status still Changes Pending or Disconnected
Pilot checklist before you walk away
Interview angle

Weak: “I would check the VIP and maybe failover.” Strong: “I show ha-status, then the virtual Reason, then the pool member Reason, then persist-records for that virtual, then one connection quadruple, then log ltm for 01010201 / 01070638. I do not write until one of those lines names the layer.”

Practise the same six shows against broken tickets in the F5 BIG-IP troubleshooting lab. The sibling lessons virtual is a listener and evidence desk use the same objects from the other side of the sentence.

Knowledge check

Six judgment items. Each maps to a promise bullet or a trap. Check answers to see reasons; Reset clears the board.

Q1

You SSH to a BIG-IP pair for a P1 on vs_payments_443. What is the first official show?

Correct: b. Standby tables are empty. Rung 1 is ha-status (sibling: show sys failover). Re-read Why the ladder exists and Side A.
Q2

show ltm virtual prints Availability offline, State enabled, Reason: The children pool member(s) are down. What do you type next?

Correct: a. The listener inherited pool state. Rung 3 is show ltm pool. Re-read the command-ladder fork and Side B.
Q3

VIP Reason says the virtual server is available. The pool is available. Users fail only at the morning peak. Which pair of shows?

Correct: a. Green listener + green pool is the available-users-fail fork: connection quadruple and LTM log (01010201). Re-read How to choose and Side C.
Q4

show ltm pool marked 10.20.30.12 offline. show ltm persistence persist-records still maps 10.10.8.22 to that node. What is the next act?

Correct: c. persist-records is a show. delete persist-records is a write (official DELETE). Re-read Side B and Traps.
Q5

show sys log ltm prints 01010201:2: Inet port exhaustion on 10.20.30.5 to 10.20.30.11:443. What ran out?

Correct: d. K8246 / K33355231: one SNAT address has a finite port set per destination. The pool stays available. Re-read Side C and Traps.
Q6

In show sys connection output, which address is the SNAT (or automap) source the pool member sees?

Correct: c. K40033505 quadruple: cs-client, cs-server (VIP), ss-client (SNAT source), ss-server (member). If ss-client equals the client, SNAT did not translate. Re-read Side C and Runtime path.

Sources

Related: A BIG-IP virtual is a listener · The F5 evidence desk · F5 interview Q&A · Troubleshooting lab