F5CAB5 BIG-IP Administration Support and Troubleshooting (F5CAB5) exam Questions and Answers

According toofficial F5 documentation (K52015891 – Troubleshooting BIG-IP power supply issues),hardware-related alerts for power supplies, fans, and chassis components are logged in /var/log/ltm.

When a BIG-IP device experiences a power supply issue—such as failure, intermittent outages, or fan-related faults—the system generates alerts through internal platform monitoring services. These alerts are written to the/var/log/ltmfile and often appear with messages similar to:

Chassis power supply 2 has experienced an issue. Status is as follows: FAN=bad; STATUS=bad.

This makes /var/log/ltm theauthoritative log filefor identifying and verifying power supply and chassis-related problems on BIG-IP systems.

The other log files are not appropriate for this purpose:

/var/log/daemon.logcontains general daemon messages but isnot the primary sourcefor chassis hardware alerts.

/var/log/kern.loglogs kernel-level events, not platform power status.

/var/log/auditrecords administrative actions and configuration changes.

Conclusion:

Per F5-supported guidance, when suspecting power supply outages or chassis hardware issues, the BIG-IP Administrator shouldalways check /var/log/ltm first.

Comprehensive and Detailed Explanation From BIG-IP Administration Support and Troubleshooting documents: When load balancing is not working as 23expected and connections appear skewed across physical hardware, the administrator must distinguish between "member"24 and "node" level balancing. A "member" refers to a specific IP and Port combination (e.g., 10.1.1.1:80), whereas a "node" refers to the underlying IP address (10.1.1.1) regardless of the port25. If a single server hosts multiple services (Web, FTP, API) across different pools, using "Least Connections (member)" would only balance connections within each individual pool26. This could lead to a scenario where one server is overwhelmed because it is winning the "least connections" count in three different pools simultaneously. By selecting "Least Connections (node)," the BIG-IP tracks the total number of concurrent connections to the physical IP address across all pools it belongs to27. This ensures that the administrator can maintain an equal distribution of work across the hardware, preventing performance degradation on backend servers that host multiple application services.

To collect application-layer details such asHTTP status codes(200, 404, 500, etc.) andHTTP methods(GET, POST, PUT, DELETE), the BIG-IP system must use a profile designed for traffic visibility and reporting rather than basic traffic handling. TheAnalytics profile (Option C)is the correct choice because it is specifically designed to collect, store, and present detailed statistics about HTTP and TCP traffic passing through a virtual server.

When an Analytics profile is attached to a virtual server, BIG-IP can record metrics such as HTTP response codes, request methods, URI paths, latency, throughput, and client-side/server-side performance data. These statistics are then accessible through the BIG-IP GUI underStatistics → Analytics, allowing administrators to validate application behavior and troubleshoot performance or functional issues.

TheHTTP profile (Option B)enables HTTP protocol awareness and features like header insertion and compression, but it does not provide historical or statistical reporting of HTTP methods and response codes.Request Adapt (Option A)is used for ICAP-based content adaptation, not visibility.Statistics (Option D)is not a standalone profile and does not provide HTTP-level insight.

Therefore, the Analytics profile is the only default profile that fulfills this requirement.

Comprehensive and Detailed Explanation From BIG-IP Administration Supp13ort and Troubleshooting documents: When troubleshooting a Virtual Server that is not working as expected, it is critical to ensure that the applied profiles match the type of traffic being processed. SSH (Secure Shell) is a non-HTTP protocol that operates over TCP. The exhibit indicates that an HTTP profile is applied to the Virtual Server14. An HTTP profile instructs the BIG-IP system to parse traffic as HTTP; however, since SSH traffic does not follow HTTP specifications, the BIG-IP's parser will fail to understand the data stream, typically resulting in dropped packets or reset connections15. To fix this, the administrator must set the HTTP profile to "None"16. This allows the Virtual Server to act as a "Standard" or "FastL4" listener that passes the encrypted SSH data transparently to the backend pool members without attempting application-layer inspection. This highlights a common troubleshooting step: verifying that L7 profiles are not inadvertently applied to L4 traffic, which disrupts the expected traffic flow between the client and the server.

Comprehensive and Detailed Explanation From BIG-IP A41dministration Support and Troubleshooting documents:To confirm functionality across a complex environment, the "Network Map" is the most efficient troubleshooting tool in the Configuration Utility43. It provides a hierarchical, visual representation of the traffic management objects44. A single glance allows the administrator to see the status of a Virtual Server (Green/Red/Yellow), the status of its associated pool, the health of individual pool members, and which iRules are currently attached45. This view is superior to the standard "Virtual Server List" for troubleshooting because it maps the dependencies between objects46. For example, if a Virtual Server is "Red," the Network Map will show if that status is inherited from a failed pool or a specific monitor failing on a pool member. Reviewing these basic stats in the Network Map helps the administrator quickly isolate whether a failure is at the service level (Virtual Server), the logic level (iRule), or the hardware level (Pool Member).

In BIG-IP TMOS administration, the "Forwarding (IP)" virtual server type is unique because it is designed to act as a high-performance router rather than a typical load balancer. Unlike a "Standard" virtual server, which terminates a connection and directs it to a specific pool of members, a Forwarding (IP) virtual server is intended to forward packets based on the system’s routing table. Consequently, the configuration for this type of virtual server explicitly removes the option to associate a default pool. If an administrator is troubleshooting a scenario where they cannot assign a pool to a virtual server, they must verify if the type was accidentally set to Forwarding (IP). This type is most commonly used for outbound internet traffic (outbound SNAT) or to allow the BIG-IP to serve as a gateway between internal subnets. Identifying this constraint is vital for troubleshooting configuration errors where an administrator expects the system to load balance traffic but finds the pool association settings are grayed out or unavailable in the Configuration Utility.

Comprehensive and Detailed 150 to 250 Words Explanation From BIG-IP Administration, Support, and Troubleshooting Documents:

These log messages indicate that the BIG-IP system’sTraffic Management Microkernel (TMM)has enteredaggressive eviction modedue tohigh global memory utilization. When TMM memory consumption reaches critical thresholds, BIG-IP activates thedefault eviction policyto protect system stability and prevent a full traffic processing failure. This condition directly corresponds toOption A, where the global eviction policy is triggered because TMM memory resources are nearing exhaustion.

Once aggressive mode is activated, BIG-IP begins using theconnection sweeper mechanism, which selectively terminates existing connections to free memory. The repeated log entries stating“1 connections killed”confirm that the system isreaping some connections, not all connections. This behavior matchesOption C. The eviction process is incremental and controlled, targeting idle, low-priority, or least-recently-used connections first to minimize impact on active traffic.

Option B is incorrect because BIG-IP doesnotdrop all connections during aggressive mode; it only removes enough connections to relieve memory pressure. Option D is also incorrect because TMM eviction is based onTMM global memory usage, not swap memory utilization. TMM does not rely on swap space in the same way the host Linux system does.

These messages are a critical warning sign that the system is under memory stress and may require traffic optimization, connection limits, or hardware scaling.

When a virtual server is not working as expected despite the pool members being marked "UP" (Green), the issue is frequently a return-path routing failure. If the BIG-IP forwards a request with the original client's source IP address, the backend server will try to respond directly to that client. If the server does not have its default gateway pointed back to the BIG-IP, the response packet will be routed elsewhere (or dropped), resulting in a connection timeout for the user. To resolve this, the administrator must configure "Source Address Translation" (SNAT). By setting SNAT to "Automap" or a specific SNAT address, the BIG-IP replaces the client's IP with its own internal self-IP. The backend server then sees the BIG-IP as the source and sends the response back to it locally. This troubleshooting step ensures a functional, symmetric tr18affic flow. Identifying the need for SNAT is one of the most common troubleshooting tasks for new virtual server deployments where the BIG-IP is not the default gateway for the backend servers.

When a pool member is markedDOWN, it indicates that the configured health monitor is failing. The most effective troubleshooting approach is to focus on the monitor behavior and the actual traffic between BIG-IP and the pool member.

Enabling monitor logging (Option B)is a recommended first step. Monitor logging provides detailed information about why the health check is failing, such as timeouts, connection refusals, incorrect responses, or unexpected status codes. This directly correlates with BIG-IP troubleshooting best practices and allows administrators to confirm whether the failure is due to application behavior, incorrect monitor configuration, or network reachability.

Collecting a TCPdump packet capture (Option D)is also a highly effective method. A packet capture allows the administrator to verify whether the monitor probes are being sent, whether responses are received, and whether packets are being dropped, reset, or malformed. This is especially valuable when diagnosing firewall issues, SSL problems, or application-level failures.

Reviewing pool statistics (Option C) is useful for general monitoring but does not explainwhya health monitor is failing. Reviewing the routing table (Option A) is typically unnecessary unless there is evidence of a broader routing issue affecting multiple destinations.