RTFM · Healthchecks
lb.saphira.icmp: is the machine there at all?
The oldest check in networking: shout "are you there?" and listen for the echo. ICMP proves the server is powered, cabled, and reachable across the network; nothing more, and that is exactly its job.
What it proves
Layer 3, the IP layer. One echo request goes out, one echo reply must come back within LB_SAPHIRA_TIMEOUT (default 3 seconds). If the host answers, the network path between director and server works. If a service on that host is dead, this check will never notice; pair it with a Layer 4 or Layer 7 check that does.
How it works
exec ping -n -c1 -W "$LB_TIMEOUT" "$LB_REAL"One ping, numeric output (no DNS lookups inside the check; the target is already an address), deadline set from the shared timeout. Dual-stack: $3 may be an IPv4 or IPv6 address and ping uses the matching family.
Configuration
| Variable | Default | Meaning |
|---|---|---|
| LB_SAPHIRA_TIMEOUT | 3 | Seconds before the echo must return |
ping needs the capability to open raw ICMP sockets. On Saphira this is standard for the ldirectord service account context it runs under; if you run the check as an unprivileged user manually and get "Operation not permitted", that is the capability, not the network.
Wiring it up
# /etc/ha.d/ldirectord.cf
virtual = 203.0.113.10:80
protocol = tcp
scheduler = wlc
real = 192.168.20.11:80 gate 1
checktype = external
checkcommand = "/var/lib/lb/saphira/lb.saphira.icmp"# haproxy.cfg
global
external-check
backend app_pool
mode tcp
option external-check
external-check command "/var/lib/lb/saphira/lb.saphira.icmp"
server app1 192.168.20.11:80 check inter 5s fall 3 rise 2Run it by hand
/var/lib/lb/saphira/lb.saphira.icmp 21 0 192.168.20.11 0
echo $?
# 0 = the host answered
# 1 = timeout or unreachable - no echo came backFailure modes, honestly
A silent host is not always a dead host. Hosts and firewalls may be configured to drop ICMP entirely; such a server will look down forever while serving perfectly. Never make ICMP the only verdict for a service; use it as the cheap first rung on a ladder with tcp or an application check above it.
- exit 1 after exactly the timeout; echo lost or filtered: host down, route broken, or ICMP dropped in transit
- exit 2 never happens here: this check has no configuration to get wrong
Did we miss something?
If this page left something unanswered, found an error, or there is another subject you would like documented, tell us. Saphira’s documentation grows from real problems people need to solve.
Send feedback or request a new section →
Prefer not to do it yourself?
Everything needed to do the work yourself is documented here and remains free; we charge for human time, not for withholding knowledge. Sometimes the missing resource is simply time. The same people who build Saphira can provide paid professional help with implementation, migration, troubleshooting and administration.