# F5 BIG-IP command ladder — six checks, one show each Source: https://ai.techclick.in/blog_f5_troubleshooting_command_ladder_cheatsheet Markdown: https://ai.techclick.in/blog_f5_troubleshooting_command_ladder_cheatsheet.md Publisher: Techclick Infosec Pvt Ltd F5 BIG-IP command ladder: six checks, one official tmsh show command each. Read ha-status, virtual Reason, pool members, persist-records, connection quadruple, and LTM log IDs before you change anything. Quick answer Start on the active unit with show sys ha-status . Then show ltm virtual (Reason, not colour), show ltm pool (member Reason), show ltm persistence persist-records (pin), show sys connection (cs/ss quadruple + SNAT source), show sys log ltm (01010201, 01070638). Delete persist, failover, and modify are change-control . Every rung on this page is a show . Say this out loud I name the layer before I name the fix. A green pool is a monitor result, not a user result. I do not type a write until I can point at a show that justifies it. ## 1. Why the ladder exists Night shift inherits INC-4412: “payments VIP is down.” Someone already typed “please failover.” The dashboard is green on one screen and red on another. If you start at persist, or at the pool, or at a reboot, you will prove things that were never broken and destroy the evidence that was. A request crossing BIG-IP LTM is one transaction. The ticket is one question: where did this transaction stop? The ladder converts that question into six official show reads. Walk them in order. Stop at the first rung you cannot clear. Hero · night desk You prove the layer before you change the pair. Training reconstruction — confirm tmsh on the software train you are about to touch. Official show only The six rungs are F5 TMSH show commands from the published reference: sys ha-status , ltm virtual , ltm pool , ltm persistence persist-records , sys connection , sys log ltm . tcpdump, curl, and openssl are useful later. They are not on this ladder. Confirm current syntax on your TMOS train before you type on a customer pair. ## 2. Six checks, one show command Pre-train the six words before you open tmsh. Unit is which box owns the traffic-group. Virtual is the listener (destination, port, VLAN, profiles, SNAT stanza) — not the application. Pool is what monitors claimed about members. Persist is a pin that can outlive a monitor. Connection is the live TMM quadruple. Log is what LTM already wrote, including faults that never turn a pool red. Model · six rungs One idea per rung. Skip a rung and you spend an hour proving the wrong layer. #### Isolate (show) ha-status · virtual · pool · persist-records · connection · log ltm. These decide the sentence you paste in the ticket. #### Change-control (write) delete persist-records · run sys failover · modify a monitor or SNAT · save / config-sync. Name the show that justifies the write. Rung Check Official command You are looking for 1 Right unit? tmsh show sys ha-status This box is active for the traffic-group. Standby tables are empty and honest. 2 Listener available, why? tmsh show ltm virtual vs_payments_443 Availability, State, Reason , Destination. Colour is decoration. 3 What did monitors mark? tmsh show ltm pool pool_payments Per-member Availability and the monitor Reason string. 4 Is a pin holding users? tmsh show ltm persistence persist-records virtual / client-addr / node-addr still on a down member. 5 Did serverside open? tmsh show sys connection cs-client · cs-server · ss-client · ss-server. ss-client is the SNAT source. 6 What did LTM already log? tmsh show sys log ltm 01070638 down, 01070727 up, 01010201 port exhaustion, 01260013 noise. Sibling of rung 1: tmsh show sys failover prints the failover state (active / standby / offline) and how long the unit has been there. Use it when you only need the one word. Use ha-status when you need the feature table that explains why a unit would leave active. ## 3. The command ladder Flowchart first. Do not start at persist-records. Do not start at failover. The order is the skill. Flow 1 · six-rung isolate ladder Six official tmsh show commands from unit to LTM log - Isolate ladder — official tmsh show only 1 ha-status active unit? 2 virtual Reason line 3 pool member Reason 4 persist pin to node? 5 conn cs / ss quad 6 log message ID Fork — Reason names the pool After rung 2, if Reason is “The children pool member(s) are down” show ltm pool pool_payments show ltm persistence persist-records The virtual is enabled. It inherited offline from the pool. Take the VIP off your list. Read member Reason. Source: TMSH show ltm virtual / pool Fork — VIP available, users fail After rung 2, if Reason is “The virtual server is available” show sys connection cs-server-addr … show sys log ltm Green listener is the start of the sentence. Look for empty ss half, ss-client = client IP, or 01010201. Source: K40033505 · K8246 Read left → right. Same six commands. Different fork after the Reason line. Diamond in prose: if children-down then pool; if available then connection + log. ## 4. Which command, which ticket One table. Match the symptom to the rung. If two rungs could apply, keep the order — never skip unit, never skip Reason. You saw / they said Type this show If it proves Next is You just SSH’d to a pair show sys ha-status Standby, or a feature already failing Isolate — move to active “VIP is down” show ltm virtual vs_payments_443 Reason: children pool member(s) are down Isolate — show the pool VIP Reason names the pool show ltm pool pool_payments Member Reason: Unable to connect / monitor down Isolate — persist-records Half of finance blank after lunch show ltm persistence persist-records virtual vs_payments_443 client-addr still on the down node-addr Change-control to delete, or wait TTL VIP available, pool available, users fail show sys connection cs-server-addr 10.10.10.50 No row, or ss-client still the client IP Isolate — SNAT none / return path Fails only at peak, dashboard green show sys log ltm 01010201 Inet port exhaustion Change-control — SNAT pool, not more members Both units claim Active show sys ha-status on each Failover path / heartbeat failed Isolate the path, then change-control You already wrote a fix show cm sync-status In Sync vs Changes Pending vs Disconnected Change-control — config-sync if you meant to persist it Choose · client to return Client → listener (rung 2) → pool (rung 3) → return (rung 5). Persist (rung 4) sits on the pin. Log (rung 6) sits under all of them. ## 5. Walk the six rungs Training reconstruction. Object names are lab examples in /Common . Output field names match the published TMSH / K-article shapes. Confirm live syntax on the train you are about to touch. ### Side A — open the ticket (rungs 1–2) #### Rung 1 · tmsh show sys ha-status Source: F5 TMSH Reference, sys ha-status. Displays HA status of a unit in a redundant pair. If this unit is not active for the traffic-group that owns the VIP, every later table will be empty and you will invent a fault. tmos · training reconstruction show sys ha-status Sys::HA Status Current active # sibling, one word only: show sys failover Status active - #### Rung 2 · tmsh show ltm virtual vs_payments_443 Source: F5 TMSH show command against ltm virtual. Read three lines: Availability, State, Reason. Enabled + offline + “children pool member(s) are down” means the listener is configured and inherited pool state. Enabled + available on a VIP users cannot reach means the break is off this object — go to rungs 5 and 6. tmos · training reconstruction show ltm virtual vs_payments_443 Ltm::Virtual Server: /Common/vs_payments_443 Status Availability : offline State : enabled Reason : The children pool member(s) are down Destination : 10.10.10.50:443 Do not rebuild the virtual Reason named the pool. The virtual is now off your list. Rebuilding destination, profiles, or SNAT here is how you create the second incident. ### Side B — pool truth and the pin (rungs 3–4) - #### Rung 3 · tmsh show ltm pool pool_payments Source: F5 TMSH Reference, ltm pool DISPLAY — show pool [name] prints statistics and status, including members. A member Availability of offline is a monitor claim, not a fact about the application. Read the member Reason. Then decide whether persist can still be sending users there. tmos · training reconstruction show ltm pool pool_payments Ltm::Pool: /Common/pool_payments Status Availability : offline Reason : The children pool member(s) are down Ltm::Pool Member: 10.20.30.11:443 Availability : available Reason : Pool member is available Ltm::Pool Member: 10.20.30.12:443 Availability : offline Reason : /Common/https: Unable to connect - #### Rung 4 · tmsh show ltm persistence persist-records Source: F5 TMSH Reference, ltm persistence persist-records. Official filters: virtual , pool , client-addr , node-addr , mode . A record on 10.20.30.12 after that member is monitor-down is the classic “VIP green-ish, half of finance blank” ticket. delete persist-records is a write. Paste the show line first. tmos · training reconstruction show ltm persistence persist-records virtual vs_payments_443 Sys::Persist virtual mode value node age vs_payments_443 source-addr 10.10.8.22 10.20.30.12:443 184 ### Side C — live flows and the log the box already wrote (rungs 5–6) - #### Rung 5 · tmsh show sys connection Source: F5 K40033505. show sys connection displays data-plane connections TMM is handling. The printed quadruple is cs-client, cs-server (VIP), ss-client (SNAT or original client), ss-server (member). Filter with cs-server-addr , cs-client-addr , ss-server-addr . If ss-client equals the client IP, SNAT did not translate. If there is no row while users retry, TMM never built the flow. tmos · training reconstruction show sys connection cs-server-addr 10.10.10.50 Sys::Connections 10.10.8.22:51221 10.10.10.50:443 10.20.30.5:41200 10.20.30.11:443 tcp 12 (tmm: 0) # ss-client 10.20.30.5 = automap / SNAT source the member sees - #### Rung 6 · tmsh show sys log ltm Source: F5 TMSH Reference, sys log — show log ltm displays Local Traffic Manager logs. This is the tmsh path when you do not drop to bash. 01070638 / 01070727 pair the monitor down/up window. 01010201 is Inet port exhaustion — pool stays available while new serverside ports run out (K8246, K33355231). 01260013 SSL handshake failed is documented as informational (K11058264) — not a root cause by itself. tmos · training reconstruction show sys log ltm 01070638:3: Pool /Common/pool_payments member 10.20.30.12:443 monitor status down. 01010201:2: Inet port exhaustion on 10.20.30.5 to 10.20.30.11:443 (proto 6) 01260013:3: SSL Handshake failed for TCP 10.10.8.40:443 Closeout show, not a conclusion After a write, re-run the same show that named the fault. Then tmsh show cm sync-status . In Sync means the peer will not reintroduce the old config on the next failover. save / config-sync are writes — they are not rungs on the isolate ladder. ## 6. Runtime path after go-live Once the VIP is in production, the same six shows map onto the live transaction. Use this when the app team asks “is it F5?” and you have sixty seconds. Proof · ticket closeout A closed ticket is a pasted show block plus In Sync — not a green screenshot. Flow 2 · one transaction, six shows Runtime path of one LTM transaction mapped to six show commands - Runtime — where each show sits on the wire Client 10.10.8.22 Virtual 10.10.10.50:443 TMM flow cs + ss quad Member 10.20.30.11:443 Reply through BIG-IP Map the show to the hop Unit owns the hop — show sys ha-status. Listener exists — show ltm virtual. Member health — show ltm pool. Pin — show ltm persistence persist-records. Quadruple — show sys connection. Hidden fault — show sys log ltm. If ss-client still equals 10.10.8.22, SNAT did not fire and the reply can leave via the server’s own gateway. Every object on the device can still report available. That is why return path is a separate rung, not an assumption. Read left → right. If the reply never recrosses the pair, rungs 2 and 3 stay green. Rung 5 names it. ## 7. Traps + proof checklist Trap What it looks like Proof from a show Started on standby Empty persist, empty connection, “nothing is wrong” show sys ha-status / show sys failover — not active Trusted the colour Pool available, users failing show sys log ltm → 01010201, or show sys connection → ss-client = client IP Rebuilt a healthy virtual Reason already said children are down show ltm virtual State enabled + Reason names the pool Ignored the pin One member down, half the users still there show ltm persistence persist-records node-addr = down member Deleted persist on the bridge Write with no pasted read Show first. Delete is change-control (TMSH persist-records DELETE) Treated 01260013 as root cause SSL handshake failed, ticket closed K11058264 — informational. Need another show (profile / connection / log pair) Fixed it, skipped sync Fault returns on the next failover show cm sync-status still Changes Pending or Disconnected Pilot checklist before you walk away Rung 1: active unit named in the ticket. - Rung 2: virtual Reason pasted, not paraphrased. - Rung 3: member Reason pasted. If one member is down, rung 4 was run. - Rung 5: one connection line with the four addresses in order. - Rung 6: message ID that matches the window, or an explicit “no 01010201 / no 01070638.” - If you wrote: re-show the same object, then show cm sync-status . Interview angle Weak: “I would check the VIP and maybe failover.” Strong: “I show ha-status, then the virtual Reason, then the pool member Reason, then persist-records for that virtual, then one connection quadruple, then log ltm for 01010201 / 01070638. I do not write until one of those lines names the layer.” Practise the same six shows against broken tickets in the F5 BIG-IP troubleshooting lab . The sibling lessons virtual is a listener and evidence desk use the same objects from the other side of the sentence. ## Knowledge check Six judgment items. Each maps to a promise bullet or a trap. Check answers to see reasons; Reset clears the board. Q1 You SSH to a BIG-IP pair for a P1 on vs_payments_443. What is the first official show? tmsh show ltm virtual vs_payments_443 tmsh show sys ha-status tmsh delete ltm persistence persist-records tmsh show sys log ltm Correct: b . Standby tables are empty. Rung 1 is ha-status (sibling: show sys failover). Re-read Why the ladder exists and Side A. Q2 show ltm virtual prints Availability offline, State enabled, Reason: The children pool member(s) are down. What do you type next? tmsh show ltm pool pool_payments Rebuild the virtual destination tmsh run sys failover standby tmsh show sys raid Correct: a . The listener inherited pool state. Rung 3 is show ltm pool. Re-read the command-ladder fork and Side B. Q3 VIP Reason says the virtual server is available. The pool is available. Users fail only at the morning peak. Which pair of shows? show sys connection and show sys log ltm show sys hardware and show sys version show ltm nat and show ltm rule show cm device and show sys raid Correct: a . Green listener + green pool is the available-users-fail fork: connection quadruple and LTM log (01010201). Re-read How to choose and Side C. Q4 show ltm pool marked 10.20.30.12 offline. show ltm persistence persist-records still maps 10.10.8.22 to that node. What is the next act? Failover the pair immediately Disable the virtual server Isolate: paste the persist line. Change-control if you delete persist-records. Ignore persist — monitors will drain it Correct: c . persist-records is a show. delete persist-records is a write (official DELETE). Re-read Side B and Traps. Q5 show sys log ltm prints 01010201:2: Inet port exhaustion on 10.20.30.5 to 10.20.30.11:443. What ran out? Pool members Management CPU The persistence table Ephemeral / SNAT source ports on the translation address Correct: d . K8246 / K33355231: one SNAT address has a finite port set per destination. The pool stays available. Re-read Side C and Traps. Q6 In show sys connection output, which address is the SNAT (or automap) source the pool member sees? cs-client-addr cs-server-addr ss-client-addr The Availability Reason on the virtual Correct: c . K40033505 quadruple: cs-client, cs-server (VIP), ss-client (SNAT source), ss-server (member). If ss-client equals the client, SNAT did not translate. Re-read Side C and Runtime path. Check answers Reset ## Sources - F5 TMSH Reference — sys ha-status . clouddocs.f5.com — sys ha-status - F5 TMSH Reference — sys failover ( show failover ). clouddocs.f5.com — sys failover - F5 TMSH Reference — show command. clouddocs.f5.com — show - F5 TMSH Reference — ltm pool DISPLAY ( show pool [name] ). clouddocs.f5.com — ltm pool - F5 TMSH Reference — ltm persistence persist-records . clouddocs.f5.com — persist-records - F5 TMSH Reference — sys log ( show log ltm ). clouddocs.f5.com — sys log - F5 K40033505 — Explaining the output of tmsh show sys connection . my.f5.com/article/K40033505 - F5 K8246 — How the BIG-IP system handles SNAT port exhaustion . my.f5.com/article/K8246 - F5 K33355231 — Error Message: 01010201 Inet port exhaustion . my.f5.com/article/K33355231 - F5 K11058264 — Error Message: 01260013 SSL handshake failed . my.f5.com/article/K11058264 Related: A BIG-IP virtual is a listener · The F5 evidence desk · F5 interview Q&A · Troubleshooting lab --- Cite this Techclick lesson with the source URL. Do not invent fees, batch dates, or job guarantees. Browse all lessons: https://ai.techclick.in/blogs AI index: https://ai.techclick.in/llms.txt