F5 iRule TCL Error: /var/log/ltm When One Path 500s and Others Work

F5 BIG-IP · Techclick CLI troubleshooting lab

One URI 500s. Other URIs on the same VIP are fine. A new iRule went in yesterday.

This is a live-ticket style lesson from Techclick Infosec. You will isolate the fault with CLI first, then prove the fix with one clean packet or log.

What you will be able to do

• Name the first CLI command to run on F5 BIG-IP for this ticket

• Separate the layer that is actually broken from the layer people blame

• Apply one scoped fix instead of a global disable

• Prove the ticket closed with a session, log, or counter

Quick answer

ltm log will show TCL errors with the iRule name and line. Fix or disable that iRule. Do not bounce the VIP.

Why this ticket shows up

A TCL exception aborts that connection. The rest of the virtual keeps working, which is why this looks 'random'.

Symptoms operators actually see

• TCL error in /var/log/ltm

• One path fails

• Recent iRule change

• HTTP 500 from the F5, not the app

CLI first — copy this block

Run these on the F5 BIG-IP device or console named in the ticket. Do not skip the first show command — it tells you which later command matters.

tail -100 /var/log/ltm | grep -i tcl
tmsh list ltm virtual VS-WEB rules
tmsh list ltm rule irule-web
tmsh show ltm virtual VS-WEB

How to read that output

The log line names the rule and often the command that failed, like [HTTP::path] on a non-HTTP event.

Triage order

1. grep TCL errors

2. Open that iRule

3. Reproduce the URI

4. Fix the event or add a catch

5. Reload only the rule

Classic traps

What you see	Real cause	Fix
Disable the VIP	One rule is broken	Remove that rule
Restart TMM	The TCL will still throw	Fix the rule
Blame the app 500	Log says TCL	It never reached the app

Proof the ticket is closed

• No new TCL errors

• URI works

• Other URIs unchanged

Say this in an interview

A single-URI fail after an iRule change is TCL until /var/log/ltm says otherwise.

---

Need the full vendor lab, mock interview, and production runbooks? Techclick trains Palo Alto, Zscaler, F5, FortiGate, Check Point, Cisco ISE, Azure and routing with live CLI — start at https://www.techclick.in/