F5 Pool Member Down: tmsh show ltm monitor When the App Is Actually Up

F5 BIG-IP · Techclick CLI troubleshooting lab

Pool member is red. The app team curl's the box and gets 200. They want the VIP enabled now.

This is a live-ticket style lesson from Techclick Infosec. You will isolate the fault with CLI first, then prove the fix with one clean packet or log.

What you will be able to do

• Name the first CLI command to run on F5 BIG-IP for this ticket

• Separate the layer that is actually broken from the layer people blame

• Apply one scoped fix instead of a global disable

• Prove the ticket closed with a session, log, or counter

Quick answer

The monitor is not your curl. show ltm monitor and the receive string. A 200 with the wrong body still marks the member down.

Why this ticket shows up

F5 health monitors are picky on send/receive, alias port, and route domain. A human curl often uses a different path or host header.

Symptoms operators actually see

• Member down, app curl 200

• Monitor receive string outdated

• HTTPS monitor without SNI

• Monitor interval too aggressive

CLI first — copy this block

Run these on the F5 BIG-IP device or console named in the ticket. Do not skip the first show command — it tells you which later command matters.

tmsh show ltm pool POOL-WEB members
tmsh show ltm monitor http mon-web
tmsh list ltm monitor http mon-web
curl -vk https://10.9.9.21/health
tmsh show ltm virtual VS-WEB

How to read that output

Read the exact send string and required receive string. If receive is 'READY' and the page now says 'OK', the member is correctly down.

Triage order

1. List the monitor attached to the pool

2. Curl the same path the monitor uses, including Host header

3. Fix send/receive or the app health page

4. Reset the member only after the monitor would pass

5. Do not force-up in production unless the change window says so

Classic traps

What you see	Real cause	Fix
Force the member up	Health page really changed	Fix the string
Disable the monitor	You will black-hole later	Fix receive
Curl /	Monitor uses /health	Match the path

Proof the ticket is closed

• Member green without force

• Monitor matches curl

• VIP serves traffic

Say this in an interview

I curl the monitor, not the homepage. A red member with a 200 on / is usually a receive-string miss.

---

Need the full vendor lab, mock interview, and production runbooks? Techclick trains Palo Alto, Zscaler, F5, FortiGate, Check Point, Cisco ISE, Azure and routing with live CLI — start at https://www.techclick.in/